Listen to this Post
How the CVE works:
Devolutions Server 2025.3.2 and earlier has a flaw in TLS certificate validation when connecting to gateways. The server does not properly verify gateway certificates during SSL/TLS handshakes. This includes inadequate checks on certificate signatures, expiration dates, and hostname matching. An attacker in a Man-in-the-Middle position can intercept connection requests. They can present a self-signed or fraudulent certificate to the server. Since validation is improper, the server accepts the malicious certificate. This establishes an encrypted session with the attacker instead of the legitimate gateway. The attacker can then decrypt, view, and modify all traffic between the server and gateway. Sensitive data like credentials and session tokens are exposed. The vulnerability stems from missing certificate pinning or trust store verification. Attackers can use tools like mitmproxy or SSLsplit to exploit this. This flaw is critical in remote access or data synchronization scenarios. It allows full traffic interception without detection. The server’s failure to validate CRL or OCSP status exacerbates the risk. Network-level attacks like ARP spoofing facilitate MitM positioning. The vulnerability is present in all versions up to 2025.3.2. It requires immediate patching to prevent data breaches.
Platform: Devolutions Server
Version: Up to 2025.3.2
Vulnerability: Improper Certificate Validation
Severity: Critical
Date: 2025-10-15
Prediction: Patch 2025-10-31
What Undercode Say:
Analytics:
openssl s_client -connect gateway:443
curl -vk https://gateway
mitmproxy –ssl-insecure
nmap –script ssl-cert
sslyze –regular gateway
tcpdump -i eth0 port 443
wireshark -k -i eth0
testssl.sh gateway:443
python -c “import ssl; print(ssl.get_server_certificate((‘gateway’,443)))”
bash script: check_cert_validity.sh
How Exploit:
Position via ARP spoofing.
Intercept with mitmproxy.
Present fake certificate.
Decrypt all traffic.
Capture credentials and data.
Protection from this CVE:
Update to 2025.3.3.
Enable certificate validation.
Implement certificate pinning.
Monitor network traffic.
Use VPNs.
Impact:
Data interception.
Unauthorized access.
Credential theft.
System compromise.
🎯Let’s Practice Exploiting & Learn Patching For Free:
Sources:
Reported By: nvd.nist.gov
Extra Source Hub:
Undercode
