CVE-2025-11493

Katalog CVE

CVSS 7.5 · High EPSS 0,23%

Kerentanan Download of Code Without Integrity Check pada connectwise automate. Skor CVSS 3.1 7.5 (High) menurut NVD.

Deskripsi (NVD)

The ConnectWise Automate Agent does not fully verify the authenticity of files downloaded from the server, such as updates, dependencies, and integrations. This creates a risk where an on-path attacker could perform a man-in-the-middle attack and substitute malicious files for legitimate ones by impersonating a legitimate server. This risk is mitigated when HTTPS is enforced and is related to CVE-2025-11492.

Rincian

Terbit di NVD

16 Oktober 2025

Terakhir diubah

9 Oktober 2026

Status NVD

Analyzed

CVSS 3.1

7.5 (High), sumber NVD
CVSS:3.1/AV:A/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-494: Download of Code Without Integrity Check

EPSS (30 hari)

0,23% peluang dieksploitasi; lebih tinggi dari 12,4% CVE lain

Produk dan versi terdampak

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

• https://www.connectwise.com/company/trust/security-bulletins/connectwise-automate-2025.9-security-fix advisory vendor