Devolutions Hub Reporting Service Improper Certificate Validation Vulnerability Allowing Man-in-the-Middle Attacks

A vulnerability exists in Devolutions Hub Reporting Service versions through 2025.3.1.1 that allows network attackers to conduct man-in-the-middle attacks. This is due to improper certificate validation, as TLS certificate verification is disabled, enabling interception and manipulation of communications.

Impact

Exploitation of this vulnerability could lead to a man-in-the-middle attack, allowing an attacker to intercept and potentially alter communications between the client and the server.

Remediation

Users are advised to upgrade to Devolutions Hub Reporting Service version 2026.1.1.0 or higher.