CVE-2025-11492

In the ConnectWise Automate Agent, communications could be configured to use HTTP instead of HTTPS. In such cases, an on-path threat actor with a man-in-the-middle network position could intercept, modify, or replay agent-server traffic. Additionally, the encryption method used to obfuscate some communications over the HTTP channel is updated in the Automate 2025.9 patch to enforce HTTPS for all agent communications.

CVSS v3 9.6 CRITICAL

9.6^/10

CVSS v3 : CRITICAL

Vector :

Exploitability : 2.8 / Impact : 6.0

Attack Vector ADJACENT_NETWORK

Attack Complexity LOW

Privileges Required NONE

User Interaction NONE

Confidentiality Impact HIGH

Integrity Impact HIGH

Availability Impact HIGH

Scope CHANGED

References

Link	Resource
https://www.connectwise.com/company/trust/security-bulletins/connectwise-automate-2025.9-security-fix	Vendor Advisory

Configurations

Configuration 1 (hide)

cpe:2.3:a:connectwise:automate:*:*:*:*:*:*:*:*

History

09 Oct 2026, 10:10

Type	Values Removed	Values Added
Summary		(es) En el Agente de ConnectWise Automate, las comunicaciones podían configurarse para usar HTTP en lugar de HTTPS. En tales casos, un actor de amenaza en la ruta con una posición de red de man-in-the-middle podría interceptar, modificar o reproducir el tráfico agente-servidor. Además, el método de cifrado utilizado para ofuscar algunas comunicaciones sobre el canal HTTP se actualiza en el parche Automate 2025.9 para forzar HTTPS para todas las comunicaciones del agente.

Information

Published : 2025-10-16 19:15

Updated : 2026-10-09 10:10

NVD link : CVE-2025-11492

Mitre link : CVE-2025-11492

CVE.ORG link : CVE-2025-11492

JSON object : View

Products Affected

connectwise

automate

CWE

CWE-319

Cleartext Transmission of Sensitive Information

{"id": "CVE-2025-11492", "cveTags": [], "metrics": {"ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2025-11492", "role": "CISA Coordinator", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "total"}], "version": "2.0.3", "timestamp": "2025-10-17T03:55:31.830163Z"}}], "cvssMetricV31": [{"type": "Secondary", "source": "7d616e1a-3288-43b1-a0dd-0a65d3e70a49", "cvssData": {"scope": "CHANGED", "version": "3.1", "baseScore": 9.6, "attackVector": "ADJACENT_NETWORK", "baseSeverity": "CRITICAL", "vectorString": "CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "NONE", "confidentialityImpact": "HIGH"}, "impactScore": 6.0, "exploitabilityScore": 2.8}, {"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 7.5, "attackVector": "ADJACENT_NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:A/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "HIGH", "availabilityImpact": "HIGH", "privilegesRequired": "NONE", "confidentialityImpact": "HIGH"}, "impactScore": 5.9, "exploitabilityScore": 1.6}]}, "affected": [{"source": "7d616e1a-3288-43b1-a0dd-0a65d3e70a49", "affectedData": [{"vendor": "ConnectWise", "modules": ["Agent"], "product": "Automate", "versions": [{"status": "affected", "version": "All versions prior to 2025.9"}], "defaultStatus": "unaffected"}]}], "published": "2025-10-16T19:15:31.900", "references": [{"url": "https://www.connectwise.com/company/trust/security-bulletins/connectwise-automate-2025.9-security-fix", "tags": ["Vendor Advisory"], "source": "7d616e1a-3288-43b1-a0dd-0a65d3e70a49"}], "vulnStatus": "Analyzed", "weaknesses": [{"type": "Secondary", "source": "7d616e1a-3288-43b1-a0dd-0a65d3e70a49", "description": [{"lang": "en", "value": "CWE-319"}]}], "descriptions": [{"lang": "en", "value": "In the ConnectWise Automate Agent, communications could be configured to use HTTP instead of HTTPS. In such cases, an on-path threat actor with a man-in-the-middle network position could intercept, modify, or replay agent-server traffic. Additionally, the encryption method used to obfuscate some communications over the HTTP channel is updated in the Automate 2025.9 patch to enforce HTTPS for all agent communications."}, {"lang": "es", "value": "En el Agente de ConnectWise Automate, las comunicaciones pod\u00edan configurarse para usar HTTP en lugar de HTTPS. En tales casos, un actor de amenaza en la ruta con una posici\u00f3n de red de man-in-the-middle podr\u00eda interceptar, modificar o reproducir el tr\u00e1fico agente-servidor. Adem\u00e1s, el m\u00e9todo de cifrado utilizado para ofuscar algunas comunicaciones sobre el canal HTTP se actualiza en el parche Automate 2025.9 para forzar HTTPS para todas las comunicaciones del agente."}], "lastModified": "2026-10-09T10:10:00.193", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:connectwise:automate:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "B9CC280B-C83A-422E-B637-44F4051703F0", "versionEndExcluding": "2025.9"}], "operator": "OR"}]}], "sourceIdentifier": "7d616e1a-3288-43b1-a0dd-0a65d3e70a49"}