CVE-2025-11493: Automate: güvenlik açığı

Açıklama (NVD)

The ConnectWise Automate Agent does not fully verify the authenticity of files downloaded from the server, such as updates, dependencies, and integrations. This creates a risk where an on-path attacker could perform a man-in-the-middle attack and substitute malicious files for legitimate ones by impersonating a legitimate server. This risk is mitigated when HTTPS is enforced and is related to CVE-2025-11492.

Özet bilgiler

Ürün

Connectwise Automate

CVSS v3.1

7.5 CVSS:3.1/AV:A/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

EPSS

%0,23 (yüzdelik 13)

CWE

CWE-494

Yama

Yok / bilinmiyor

Etkilenen sürümler

Kaynaklar

• NVD kaydı
• www.connectwise.com
• CWE-494