CVE-2026-78417 Insufficient verification of data authenticity in the IronVNC client in Devolutions Remote Desktop Manager 2026.2.17.0 and earlier, 2026.1.24.0 and earlier, allows an on-path attacker to intercept and...

MediumCVSS 4.3 EPSS 0.15%

Published: 2026-08-24 21:26
Updated: 2026-10-12 18:10
Exploit status: No public exploit known

Description

Insufficient verification of data authenticity in the IronVNC client in Devolutions Remote Desktop Manager 2026.2.17.0 and earlier, 2026.1.24.0 and earlier, allows an on-path attacker to intercept and tamper with VNC sessions via automatic acceptance of the server's RSA key during RSA-AES authentication.

Affected products

Product	Affected versions	Fixed in
Devolutions Remote Desktop Manager	< 2026.2.18	2026.2.18
Devolutions Remote Desktop Manager	< 2026.1.25	2026.1.25

References

devolutions.net

CVSS v3.1

4.3 Medium

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N

Attack Vector: Network
Attack Complexity: Low
Privileges Required: None
User Interaction: Required
Scope: Unchanged
Confidentiality: None
Integrity: Low
Availability: None

Weakness & likelihood

EPSS (exploitation probability, 30 days): 0.15% (percentile 4.6)
CWE: CWE-345 Insufficient Verification of Data Authenticity

Public exploit references

Metadata only. CVERadar never hosts or runs exploit code.

No public exploit references known.