CVE-2025-11492
CRITICALConnectWise Automate < 2025.9 - Cleartext Transmission of Sensitive Information via HTTP
Title source: llmExploitation Summary
EIP tracks 1 public exploit for CVE-2025-11492. PoCs published by synap5e.
AI-analyzed exploit summary This repository contains a proof-of-concept for CVE-2025-11492, demonstrating an Adversary-in-the-Middle (AiTM) attack against ConnectWise Automate RMM agents. The exploit leverages insufficient protocol security and validation flaws to achieve remote code execution (RCE) as SYSTEM by coercing the agent into downloading and executing a malicious plugin.
Description
In the ConnectWise Automate Agent, communications could be configured to use HTTP instead of HTTPS. In such cases, an on-path threat actor with a man-in-the-middle network position could intercept, modify, or replay agent-server traffic. Additionally, the encryption method used to obfuscate some communications over the HTTP channel is updated in the Automate 2025.9 patch to enforce HTTPS for all agent communications.
Exploits (1)
This repository contains a proof-of-concept for CVE-2025-11492, demonstrating an Adversary-in-the-Middle (AiTM) attack against ConnectWise Automate RMM agents. The exploit leverages insufficient protocol security and validation flaws to achieve remote code execution (RCE) as SYSTEM by coercing the agent into downloading and executing a malicious plugin.
References (1)
Scores
CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H