CVE-2025-11492: HTTP Configuration and Encryption in Transit
In the ConnectWise Automate Agent, communications could be configured to use HTTP instead of HTTPS. In such cases, an on-path threat actor with a man-in-the-middle network position could intercept, modify, or replay agent-server traffic. Additionally, the encryption method used to obfuscate some communications over the HTTP channel is updated in the Automate 2025.9 patch to enforce HTTPS for all agent communications.
Affected Software
Remediation
Information
Event History
Frequently Asked Questions
What is the severity of CVE-2025-11492?
CVE-2025-11492 has been rated as a critical vulnerability due to the potential for man-in-the-middle attacks.
How do I fix CVE-2025-11492?
To fix CVE-2025-11492, ensure that your ConnectWise Automate Agent is configured to use HTTPS for all communications.
What are the risks associated with CVE-2025-11492?
The risks include the possibility of an attacker intercepting, modifying, or replaying traffic between the agent and the server.
Which versions of ConnectWise Automate Agent are affected by CVE-2025-11492?
CVE-2025-11492 affects ConnectWise Automate Agent versions prior to 2025.9.
What type of attacks can exploit CVE-2025-11492?
CVE-2025-11492 can be exploited through man-in-the-middle attacks due to the use of unsecured HTTP communications.