PT-2025-42523 · Connectwise · Connectwise Automate Agent

Published 2025-10-16 · Updated 2025-11-23 · CVE-2025-11492

Positive Technologies (AI Summary)

CVSS v3.1

9.6

Critical

Base vector

AV:A/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions ConnectWise Automate versions prior to 2025.9

Description The ConnectWise Automate Agent could be configured to use HTTP instead of HTTPS for communications. This allows an attacker positioned on the network to intercept, modify, or replay agent-server traffic. The encryption method used for some communications over HTTP has been updated in version 2025.9 to enforce HTTPS for all agent communications, mitigating the risk. This issue could allow attackers to inject malicious commands into Remote Management and Monitoring (RMM) traffic and potentially steal credentials.

Recommendations Update ConnectWise Automate to version 2025.9 or later to enforce HTTPS for all agent communications.

Fix

RCE

Cleartext Transmission of Sensitive Information

Weakness Enumeration

CWE-319

Related Identifiers

BDU:2025-14619

CVE-2025-11492

Affected Products

Connectwise Automate Agent

References · 23

• https://osv.dev/vulnerability/CVE-2025-11492 · Vendor Advisory
• https://bdu.fstec.ru/vul/2025-14619 · Security Note
• https://connectwise.com/company/trust/security-bulletins/connectwise-automate-2025.9-security-fix · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2025-11492 · Security Note
• https://github.com/synap5e/connectwise-automate-AiTM-rce · Note
• https://twitter.com/PurpleOps_io/status/1979049936013390188 · Twitter Post
• https://twitter.com/zoomeye_team/status/1979022023528714331 · Twitter Post
• https://twitter.com/CVEnew/status/1978926545268776961 · Twitter Post
• https://twitter.com/Komodosec/status/1992625009370828805 · Twitter Post
• https://t.me/CVEtracker/35137 · Telegram Post
• https://t.me/cveNotify/140879 · Telegram Post
• https://twitter.com/CCBalert/status/1980707153519247839 · Twitter Post
• https://reddit.com/r/pwnhub/comments/1obj43a/connectwise_fixes_critical_flaw_in_automate_tool · Reddit Post
• https://t.me/cveNotify/140880 · Telegram Post
• https://twitter.com/PurpleOps_io/status/1979442719563882832 · Twitter Post