CVE-2025-56231

CRITICAL

Tonec Internet Download Manager - Improper Certificate Validation

Title source: rule
STIX 2.1

Description

Tonec Internet Download Manager 6.42.41.1 and earlier suffers from Missing SSL Certificate Validation, which allows attackers to bypass update protections.

References (2)

Scores

CVSS v3 9.1
EPSS 0.0004
EPSS Percentile 10.9%
Attack Vector NETWORK
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N

CISA SSVC

Vulnrichment
Exploitation poc
Automatable yes
Technical Impact partial

Details

CWE
CWE-295
Status published
Products (1)
tonec/internet_download_manager < 6.42.41.1
Published Nov 05, 2025
Tracked Since Feb 18, 2026