CVE-2023-4373
📋 TL;DR
This vulnerability in Devolutions Remote Desktop Manager allows users to bypass permission checks when using remote tools and macros, enabling unauthorized connections. It affects versions 2023.2.19 and earlier, potentially allowing privilege escalation or unauthorized access to remote systems.
💻 Affected Systems
- Devolutions Remote Desktop Manager
📦 What is this software?
⚠️ Risk & Real-World Impact
Worst Case
Attackers could gain unauthorized access to sensitive remote systems, execute arbitrary commands, or steal credentials through privilege escalation.
Likely Case
Unauthorized users could access remote systems they shouldn't have permissions for, potentially leading to data exposure or lateral movement.
If Mitigated
With proper access controls and network segmentation, impact would be limited to unauthorized connections within permitted network segments.
🎯 Exploit Status
Requires user access to the Remote Desktop Manager application but bypasses permission checks within the application.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: 2023.2.20 or later
Vendor Advisory: https://devolutions.net/security/advisories/DEVO-2023-0015/
Restart Required: Yes
Instructions:
1. Download latest version from Devolutions website. 2. Run installer. 3. Restart Remote Desktop Manager. 4. Verify version is 2023.2.20 or higher.
🔧 Temporary Workarounds
Disable Remote Tools Feature
allTemporarily disable the remote tools and macros functionality until patched.
Navigate to Tools > Options > Security > Disable 'Enable remote tools' and 'Enable macros'
🧯 If You Can't Patch
- Restrict user permissions to only essential personnel
- Implement network segmentation to isolate Remote Desktop Manager instances
🔍 How to Verify
Check if Vulnerable:
Check Help > About in Remote Desktop Manager for version number. If version is 2023.2.19 or earlier, system is vulnerable.Check Version:
In Remote Desktop Manager: Help > AboutVerify Fix Applied:
Verify version is 2023.2.20 or later in Help > About menu.📡 Detection & Monitoring
Log Indicators:
- Unexpected connection attempts via remote tools
- Macro execution without proper permissions
Network Indicators:
- Unusual RDP/VNC/SSH connections originating from Remote Desktop Manager hosts
SIEM Query:
source="RemoteDesktopManager" AND (event="UnauthorizedConnection" OR event="PermissionBypass")