This vulnerability involves insufficient verification of data authenticity (CWE-345) in the IronVNC client component of Devolutions Remote Desktop Manager. Specifically, the client automatically accepts the server's RSA key during RSA-AES authentication without proper verification, enabling an attacker positioned on the communication path to intercept and manipulate VNC sessions. The affected versions include 2026.2.17.0 and earlier, and 2026.1.24.0 and earlier. No CVSS score or vendor remediation information is currently available.

An attacker capable of intercepting network traffic can exploit this vulnerability to tamper with VNC sessions, potentially compromising the confidentiality and integrity of remote desktop communications. This could lead to unauthorized access or manipulation of remote sessions.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, users should consider avoiding use of affected versions in untrusted networks or use additional network-layer protections such as VPNs or secure tunnels to mitigate on-path interception risks.