Devolutions Hub Reporting Service versions 2025.3.1.1 and earlier perform improper TLS certificate validation, allowing an attacker on the same network to intercept and modify traffic. This flaw can lead to a man‑in‑the‑middle attack, compromising confidentiality and integrity of data exchanged by the service. The weakness corresponds to CWE‑295, where certificate checks are bypassed.

The affected product is Devolutions Hub Reporting Service, version 2025.3.1.1 and earlier. Users running any of those releases on their networks are vulnerable. The vulnerability is specific to the devaluations indicated by the vendor and the cpe string indicates only this product.

The CVSS score of 8.3 indicates high severity, while the EPSS score of less than 1% suggests a low probability of exploitation in the wild. The vulnerability is not yet cataloged in the CISA KEV list. Attackers would need control over the network path to the reporting service and could exploit the disabled TLS verification to pass through the traffic. Because the flaw is a certificate‑validation bypass, it is an in‑network attack vector; its risk is significant but exploitation likelihood is currently low.