CVE-2026-78417 — Insufficient verification of data authenticity in the IronVNC client in Devolutions Remote Desktop Manager 2026.2.17.0 and earlier, 2026.1.24.0 and earlier, allows an on-path attacker to intercept and tamper with VNC sessions via automatic acceptance of the server's RSA key during RSA-AES authentication

Back Back to CVE browser

MEDIUM

Insufficient verification of data authenticity in the IronVNC client in Devolutions Remote Desktop Manager 2026.2.17.0 and earlier, 2026.1.24.0 and earlier, allows an on-path attacker to intercept and tamper with VNC sessions via automatic acceptance of the server's RSA key during RSA-AES authentication

Published Aug 24, 2026

4.3

MEDIUM

CVSS 3.1

EPSS 0.15%

Description

Insufficient verification of data authenticity in the IronVNC client in Devolutions Remote Desktop Manager 2026.2.17.0 and earlier, 2026.1.24.0 and earlier, allows an on-path attacker to intercept and tamper with VNC sessions via automatic acceptance of the server's RSA key during RSA-AES authentication.

Affected products

Vendor Devolutions Product Remote Desktop Manager Default
unaffected
- Version
  0
  Status
  affected
  Constraints
  <2026.1.25
- Version
  0
  Status
  affected
  Constraints
  <2026.2.18