CVE-2025-11493: Self-Update Verification Mechanism Process in ConnectWise Automate
The ConnectWise Automate Agent does not fully verify the authenticity of files downloaded from the server, such as updates, dependencies, and integrations. This creates a risk where an on-path attacker could perform a man-in-the-middle attack and substitute malicious files for legitimate ones by impersonating a legitimate server. This risk is mitigated when HTTPS is enforced and is related to CVE-2025-11492.
Affected Software
Remediation
Information
Event History
Frequently Asked Questions
What is the severity of CVE-2025-11493?
CVE-2025-11493 is considered a high-severity vulnerability due to the potential for man-in-the-middle attacks.
How do I fix CVE-2025-11493?
To mitigate CVE-2025-11493, ensure that you apply the latest security updates released by ConnectWise for Automate.
What impact does CVE-2025-11493 have on my system?
CVE-2025-11493 can allow an attacker to substitute malicious files for legitimate updates, potentially compromising your system.
Is my system affected by CVE-2025-11493?
If you are using ConnectWise Automate, your system may be vulnerable to CVE-2025-11493.
What should I do if I suspect exploitation of CVE-2025-11493?
If you suspect exploitation of CVE-2025-11493, immediately review your system's integrity and consult ConnectWise for guidance.