CVE-2025-4876

ConnectWise-Password-Encryption-Utility.exe in ConnectWise Risk Assessment allows an attacker to extract a hardcoded AES decryption key via reverse engineering. This key is embedded in plaintext within the binary and used in cryptographic operations without dynamic key management. Once obtained the key can be used to decrypt CSV input files used for authenticated network scanning.

CVSS v3 6.0 MEDIUM

6.0^/10

CVSS v3 : MEDIUM

Vector :

Exploitability : 1.5 / Impact : 4.0

Attack Vector LOCAL

Attack Complexity LOW

Privileges Required HIGH

User Interaction NONE

Confidentiality Impact HIGH

Integrity Impact NONE

Availability Impact NONE

Scope CHANGED

References

Link	Resource
https://github.com/packetlabs/vulnerability-advisory/blob/main/Disclosures/PL-2025-11315/README.md	Third Party Advisory

Configurations

Configuration 1 (hide)

cpe:2.3:a:connectwise:risk_assessment:*:*:*:*:*:*:*:*

History

No history.

Information

Published : 2025-05-19 16:15

Updated : 2025-10-02 01:42

NVD link : CVE-2025-4876

Mitre link : CVE-2025-4876

CVE.ORG link : CVE-2025-4876

JSON object : View

Products Affected

connectwise

risk_assessment

CWE

CWE-321

Use of Hard-coded Cryptographic Key

{"id": "CVE-2025-4876", "cveTags": [], "metrics": {"cvssMetricV31": [{"type": "Secondary", "source": "7d616e1a-3288-43b1-a0dd-0a65d3e70a49", "cvssData": {"scope": "CHANGED", "version": "3.1", "baseScore": 6.0, "attackVector": "LOCAL", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:C/C:H/I:N/A:N", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "HIGH", "confidentialityImpact": "HIGH"}, "impactScore": 4.0, "exploitabilityScore": 1.5}, {"type": "Primary", "source": "[email protected]", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 4.4, "attackVector": "LOCAL", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "HIGH", "confidentialityImpact": "HIGH"}, "impactScore": 3.6, "exploitabilityScore": 0.8}]}, "published": "2025-05-19T16:15:35.107", "references": [{"url": "https://github.com/packetlabs/vulnerability-advisory/blob/main/Disclosures/PL-2025-11315/README.md", "tags": ["Third Party Advisory"], "source": "7d616e1a-3288-43b1-a0dd-0a65d3e70a49"}], "vulnStatus": "Analyzed", "weaknesses": [{"type": "Secondary", "source": "7d616e1a-3288-43b1-a0dd-0a65d3e70a49", "description": [{"lang": "en", "value": "CWE-321"}]}], "descriptions": [{"lang": "en", "value": "ConnectWise-Password-Encryption-Utility.exe in ConnectWise Risk Assessment allows an attacker to extract a hardcoded AES decryption key via reverse engineering. This key is embedded in plaintext within the binary and used in cryptographic operations without dynamic key management. Once obtained the key can be used to decrypt CSV input files\u00a0used for authenticated network scanning."}, {"lang": "es", "value": "ConnectWise-Password-Encryption-Utility.exe, en la Evaluaci\u00f3n de Riesgos de ConnectWise, permite a un atacante extraer una clave de descifrado AES codificada mediante ingenier\u00eda inversa. Esta clave se incrusta en texto plano dentro del binario y se utiliza en operaciones criptogr\u00e1ficas sin gesti\u00f3n din\u00e1mica de claves. Una vez obtenida, la clave puede utilizarse para descifrar archivos CSV de entrada utilizados para el escaneo de red autenticado."}], "lastModified": "2025-10-02T01:42:14.220", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:connectwise:risk_assessment:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "F16CBD69-2DC0-4D6E-8A30-A7A27700F61B", "versionEndExcluding": "2023-07-01"}], "operator": "OR"}]}], "sourceIdentifier": "7d616e1a-3288-43b1-a0dd-0a65d3e70a49"}