CVE-2023-1939: No access control for the OTP key on OTP entries

Severity: medium (CVSS 4.3 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.4% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2023-04-11 · updated 2026-06-17
Weakness: CWE-732

Description

No access control for the OTP key on OTP entries in Devolutions Remote Desktop Manager Windows 2022.3.33.0 and prior versions and Remote Desktop Manager Linux 2022.3.2.0 and prior versions allows non admin users to see OTP keys via the user interface.

Affected products

Devolutions Remote Desktop Manager: through 2022.3.2.0; through 2022.3.33.0

References

https://devolutions.net/security/advisories/DEVO-2023-0009
https://devolutions.net/security/advisories/DEVO-2023-0009

Get alerted when CVE-2023-1939 or the next vulnerability affects your stack