CVE-2025-11492

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2025-11492", "assignerOrgId": "7d616e1a-3288-43b1-a0dd-0a65d3e70a49", "state": "PUBLISHED", "assignerShortName": "ConnectWise", "dateReserved": "2025-10-08T11:25:59.180Z", "datePublished": "2025-10-16T18:59:35.285Z", "dateUpdated": "2026-02-26T16:57:25.098Z"}, "containers": {"cna": {"affected": [{"defaultStatus": "unaffected", "modules": ["Agent"], "product": "Automate", "vendor": "ConnectWise", "versions": [{"status": "affected", "version": "All versions prior to 2025.9"}]}], "descriptions": [{"lang": "en", "supportingMedia": [{"base64": false, "type": "text/html", "value": "In the ConnectWise Automate Agent, communications could be configured to use HTTP instead of HTTPS. In such cases, an on-path threat actor with a man-in-the-middle network position could intercept, modify, or replay agent-server traffic. Additionally, the encryption method used to obfuscate some communications over the HTTP channel is updated in the Automate 2025.9 patch to enforce HTTPS for all agent communications.<br><br><div><div><div>\n\n</div>\n\n</div>\n\n</div>"}], "value": "In the ConnectWise Automate Agent, communications could be configured to use HTTP instead of HTTPS. In such cases, an on-path threat actor with a man-in-the-middle network position could intercept, modify, or replay agent-server traffic. Additionally, the encryption method used to obfuscate some communications over the HTTP channel is updated in the Automate 2025.9 patch to enforce HTTPS for all agent communications."}], "impacts": [{"capecId": "CAPEC-94", "descriptions": [{"lang": "en", "value": "CAPEC-94 Adversary in the Middle (AiTM)"}]}], "metrics": [{"cvssV3_1": {"attackComplexity": "LOW", "attackVector": "ADJACENT_NETWORK", "availabilityImpact": "HIGH", "baseScore": 9.6, "baseSeverity": "CRITICAL", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "scope": "CHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H", "version": "3.1"}, "format": "CVSS", "scenarios": [{"lang": "en", "value": "GENERAL"}]}], "problemTypes": [{"descriptions": [{"cweId": "CWE-319", "description": "CWE-319 Cleartext Transmission of Sensitive Information", "lang": "en", "type": "CWE"}]}], "providerMetadata": {"orgId": "7d616e1a-3288-43b1-a0dd-0a65d3e70a49", "shortName": "ConnectWise", "dateUpdated": "2025-10-16T18:59:35.285Z"}, "references": [{"url": "https://www.connectwise.com/company/trust/security-bulletins/connectwise-automate-2025.9-security-fix"}], "solutions": [{"lang": "en", "supportingMedia": [{"base64": false, "type": "text/html", "value": "<p><b>Cloud:&nbsp;</b>Cloud instances have already been updated to the latest\nAutomate release. &nbsp;&nbsp;</p>\n\n\n\n\n\n<p><b>On-premise:&nbsp;</b>Apply the 2025.9\nrelease.</p>\n\n\n\n\n\n\n\n<br>"}], "value": "Cloud:\u00a0Cloud instances have already been updated to the latest\nAutomate release. \u00a0\u00a0\n\n\n\n\n\n\n\nOn-premise:\u00a0Apply the 2025.9\nrelease."}], "source": {"discovery": "UNKNOWN"}, "title": "HTTP Configuration and Encryption in Transit", "x_generator": {"engine": "Vulnogram 0.2.0"}}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2025-11492", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "total"}], "version": "2.0.3", "timestamp": "2025-10-17T03:55:31.830163Z"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-02-26T16:57:25.098Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2025-11492", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "total"}], "version": "2.0.3", "timestamp": "2025-10-17T03:55:31.830163Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-01-07T17:05:34.859Z"}}], "cna": {"title": "HTTP Configuration and Encryption in Transit", "source": {"discovery": "UNKNOWN"}, "impacts": [{"capecId": "CAPEC-94", "descriptions": [{"lang": "en", "value": "CAPEC-94 Adversary in the Middle (AiTM)"}]}], "metrics": [{"format": "CVSS", "cvssV3_1": {"scope": "CHANGED", "version": "3.1", "baseScore": 9.6, "attackVector": "ADJACENT_NETWORK", "baseSeverity": "CRITICAL", "vectorString": "CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "NONE", "confidentialityImpact": "HIGH"}, "scenarios": [{"lang": "en", "value": "GENERAL"}]}], "affected": [{"vendor": "ConnectWise", "modules": ["Agent"], "product": "Automate", "versions": [{"status": "affected", "version": "All versions prior to 2025.9"}], "defaultStatus": "unaffected"}], "solutions": [{"lang": "en", "value": "Cloud:\u00a0Cloud instances have already been updated to the latest\nAutomate release. \u00a0\u00a0\n\n\n\n\n\n\n\nOn-premise:\u00a0Apply the 2025.9\nrelease.", "supportingMedia": [{"type": "text/html", "value": "<p><b>Cloud:&nbsp;</b>Cloud instances have already been updated to the latest\nAutomate release. &nbsp;&nbsp;</p>\n\n\n\n\n\n<p><b>On-premise:&nbsp;</b>Apply the 2025.9\nrelease.</p>\n\n\n\n\n\n\n\n<br>", "base64": false}]}], "references": [{"url": "https://www.connectwise.com/company/trust/security-bulletins/connectwise-automate-2025.9-security-fix"}], "x_generator": {"engine": "Vulnogram 0.2.0"}, "descriptions": [{"lang": "en", "value": "In the ConnectWise Automate Agent, communications could be configured to use HTTP instead of HTTPS. In such cases, an on-path threat actor with a man-in-the-middle network position could intercept, modify, or replay agent-server traffic. Additionally, the encryption method used to obfuscate some communications over the HTTP channel is updated in the Automate 2025.9 patch to enforce HTTPS for all agent communications.", "supportingMedia": [{"type": "text/html", "value": "In the ConnectWise Automate Agent, communications could be configured to use HTTP instead of HTTPS. In such cases, an on-path threat actor with a man-in-the-middle network position could intercept, modify, or replay agent-server traffic. Additionally, the encryption method used to obfuscate some communications over the HTTP channel is updated in the Automate 2025.9 patch to enforce HTTPS for all agent communications.<br><br><div><div><div>\n\n</div>\n\n</div>\n\n</div>", "base64": false}]}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-319", "description": "CWE-319 Cleartext Transmission of Sensitive Information"}]}], "providerMetadata": {"orgId": "7d616e1a-3288-43b1-a0dd-0a65d3e70a49", "shortName": "ConnectWise", "dateUpdated": "2025-10-16T18:59:35.285Z"}}}, "cveMetadata": {"cveId": "CVE-2025-11492", "state": "PUBLISHED", "dateUpdated": "2026-02-26T16:57:25.098Z", "dateReserved": "2025-10-08T11:25:59.180Z", "assignerOrgId": "7d616e1a-3288-43b1-a0dd-0a65d3e70a49", "datePublished": "2025-10-16T18:59:35.285Z", "assignerShortName": "ConnectWise"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"defaultStatus": "unaffected", "modules": ["Agent"], "product": "Automate", "vendor": "ConnectWise", "versions": [{"status": "affected", "version": "All versions prior to 2025.9"}]}], "source": "7d616e1a-3288-43b1-a0dd-0a65d3e70a49"}], "configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:connectwise:automate:*:*:*:*:*:*:*:*", "matchCriteriaId": "B9CC280B-C83A-422E-B637-44F4051703F0", "versionEndExcluding": "2025.9", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "cveTags": [], "descriptions": [{"lang": "en", "value": "In the ConnectWise Automate Agent, communications could be configured to use HTTP instead of HTTPS. In such cases, an on-path threat actor with a man-in-the-middle network position could intercept, modify, or replay agent-server traffic. Additionally, the encryption method used to obfuscate some communications over the HTTP channel is updated in the Automate 2025.9 patch to enforce HTTPS for all agent communications."}, {"lang": "es", "value": "En el Agente de ConnectWise Automate, las comunicaciones pod\u00edan configurarse para usar HTTP en lugar de HTTPS. En tales casos, un actor de amenaza en la ruta con una posici\u00f3n de red de man-in-the-middle podr\u00eda interceptar, modificar o reproducir el tr\u00e1fico agente-servidor. Adem\u00e1s, el m\u00e9todo de cifrado utilizado para ofuscar algunas comunicaciones sobre el canal HTTP se actualiza en el parche Automate 2025.9 para forzar HTTPS para todas las comunicaciones del agente."}], "id": "CVE-2025-11492", "lastModified": "2026-10-09T10:10:00.193", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "ADJACENT_NETWORK", "availabilityImpact": "HIGH", "baseScore": 9.6, "baseSeverity": "CRITICAL", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "scope": "CHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H", "version": "3.1"}, "exploitabilityScore": 2.8, "impactScore": 6.0, "source": "7d616e1a-3288-43b1-a0dd-0a65d3e70a49", "type": "Secondary"}, {"cvssData": {"attackComplexity": "HIGH", "attackVector": "ADJACENT_NETWORK", "availabilityImpact": "HIGH", "baseScore": 7.5, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:A/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H", "version": "3.1"}, "exploitabilityScore": 1.6, "impactScore": 5.9, "source": "nvd@nist.gov", "type": "Primary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2025-11492", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "total"}], "role": "CISA Coordinator", "timestamp": "2025-10-17T03:55:31.830163Z", "version": "2.0.3"}}]}, "published": "2025-10-16T19:15:31.900", "references": [{"source": "7d616e1a-3288-43b1-a0dd-0a65d3e70a49", "tags": ["Vendor Advisory"], "url": "https://www.connectwise.com/company/trust/security-bulletins/connectwise-automate-2025.9-security-fix"}], "sourceIdentifier": "7d616e1a-3288-43b1-a0dd-0a65d3e70a49", "vulnStatus": "Analyzed", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-319"}], "source": "7d616e1a-3288-43b1-a0dd-0a65d3e70a49", "type": "Secondary"}]}

{}

{"created": "2025-10-20T13:24:54.307733+00:00", "updated": "2025-10-20T13:24:54.307759+00:00", "vendors": ["connectwise", "connectwise$PRODUCT$automate"]}