---
cve: "CVE-2025-6523"
severity: "CRITICAL"
cvss: 9.5
epss: "0.5%"
vendor: "Devolutions"
kev: false
exploited: false
published: "2025-07-22 17:15:33"
tags: [cve, security, critical]
source: tsecurity.de CVE-Dossier
exported: "2026-11-09T15:50:12+01:00"
---

# CVE-2025-6523

> 9.5 CRITICAL

## Beschreibung

Use of weak credentials in emergency authentication component in Devolutions Server allows an unauthenticated attacker to bypass authentication via brute forcing the short emergency codes generated by the server within a feasible timeframe.

This issue affects the following versions :

  *  Devolutions Server 2025.2.2.0 through 2025.2.3.0
  *  
Devolutions Server 2025.1.11.0 and earlier

## CNA-Record (Kanon, cvelistV5)

- CNA: **DEVOLUTIONS**
- State: PUBLISHED
- Stand: 2025-11-25 17:23:40
- CNA-CVSS: **9.5** (`CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:H/VI:H/VA:L/SC:H/SI:H/SA:H`)

## CISA-Anreicherung (vulnrichment/ADP)

- CISA-SSVC (Coordinator, v2.0.3):
  - Exploitation: **none**
  - Automatable: **no**
  - Technical Impact: **partial**

## CVSS-Vektor

```
CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:H/VI:H/VA:L/SC:H/SI:H/SA:H
```

| Metrik | Wert | Bewertung |
|---|---|---|
| AV Angriffsvektor | Netzwerk | bad |
| AC Komplexität | Hoch | good |
| PR Privilegien | Keine | bad |
| UI Interaktion | Keine | bad |

## Schwachstellen-Klasse

- **CWE-1391** — Use of Weak Credentials
  The product uses weak credentials (such as a default key or hard-coded password) that can be calculated, derived, reused, or guessed by an attacker.

## BSI-Hinweise (deutsch)

- [Devolutions Server: Mehrere Schwachstellen](https://wid.cert-bund.de/portal/wid/sicherheitshinweis/WID-SEC-W-2025-1626) — _BSI-Einstufung: mittel_
  Ein Angreifer kann mehrere Schwachstellen in Devolutions Server ausnutzen, um Sicherheitsvorkehrungen zu umgehen, und um Informationen offenzulegen.

## Referenzen

- <https://devolutions.net/security/advisories/DEVO-2025-0012/>

---
_Exportiert aus dem [tsecurity.de CVE-Dossier](https://tsecurity.de/sicherheitsluecken/cve-2025-6523/) · Datenquellen: EUVD (ENISA), NVD, OSV, CISA KEV, FIRST EPSS, Exploit-DB, BSI WID (CSAF)_