Description
Insufficient verification of data authenticity in the IronVNC client in Devolutions Remote Desktop Manager 2026.2.17.0 and earlier, 2026.1.24.0 and earlier, allows an on-path attacker to intercept and tamper with VNC sessions via automatic acceptance of the server's RSA key during RSA-AES authentication.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| Devolutions | Remote Desktop Manager | < 2026.2.18, < 2026.1.25 | 2026.2.18 |
Advisories 1
- WID-SEC-2026-2982 Devolutions Remote Desktop Manager: Schwachstelle ermöglicht Manipulation von Daten BSI CERT-Bund (WID) · Aug 24, 2026