PT-2025-22018 · Connectwise · Connectwise Risk Assessment

Ian Lin + 1 · Published 2025-05-19 · Updated 2025-08-13 · CVE-2025-4876

Positive Technologies (AI Summary)

CVSS v3.1

6.0

Medium

Base vector

AV:L/AC:L/PR:H/UI:N/S:C/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions: ConnectWise Risk Assessment (affected versions not specified)

Description: The issue allows an attacker to extract a hardcoded AES decryption key via reverse engineering from the ConnectWise-Password-Encryption-Utility.exe in ConnectWise Risk Assessment. This key is embedded in plaintext within the binary and used in cryptographic operations without dynamic key management. Once obtained, the key can be used to decrypt CSV input files used for authenticated network scanning.

Recommendations: At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Using Hardcoded Credentials

Weakness Enumeration

CWE-321

CWE-798

Related Identifiers

CVE-2025-4876

Affected Products

Connectwise Risk Assessment

References · 6

• https://nvd.nist.gov/vuln/detail/CVE-2025-4876 · Security Note
• https://osv.dev/vulnerability/CVE-2025-4876 · Vendor Advisory
• https://github.com/packetlabs/vulnerability-advisory/blob/main/Disclosures/PL-2025-11315/README.md · Note
• https://t.me/cveNotify/132095 · Telegram Post
• https://t.me/cvetracker/24251 · Telegram Post
• https://twitter.com/CVEnew/status/1924507451316949131 · Twitter Post