The vulnerability pertains to a defective masking mechanism in the TeamViewer entry dashboard component of Devolutions Remote Desktop Manager. Due to this flaw, an external observer—either in person or via screen sharing—can see displayed passwords on the screen. The weakness enables an attacker to steal credentials, compromising confidentiality of stored passwords. The issue is a classic information disclosure flaw as identified by CWE-200.

Devolutions Remote Desktop Manager versions 2025.3.24.0 through 2025.3.28.0 running on Windows environments are affected. Users of these builds who store passwords in the TeamViewer entry dashboard component are at risk.

The CVSS score of 3.3 indicates low severity, but the practical impact is significant for individuals handling sensitive credentials. EPSS indicates that exploitation probability is below 1%, so widespread attacks are unlikely at this time. The vulnerability is not listed in the CISA KEV database, and no public exploits have been documented. An attacker would require access to the physical machine or a screen sharing session; therefore, the attack vector is predominantly physical or insider-based.