CVE-2026-78417

Summary

Insufficient verification of data authenticity in the IronVNC client in Devolutions Remote Desktop Manager 2026.2.17.0 and earlier, 2026.1.24.0 and earlier, allows an on-path attacker to intercept and tamper with VNC sessions via automatic acceptance of the server's RSA key during RSA-AES authentication.

Affected Software

Weaknesses

• CWE-345: CWE-345 Insufficient Verification of Data Authenticity

ADP Enrichment

CISA ADP Vulnrichment

• SSVC:
• Exploitation: none
  • Automatable: no
  • Technical Impact: partial

References

• https://devolutions.net/security/advisories/DEVO-2026-0029/

• ←Previous
• Next→