CVE-2025-10548
Missing Certificate Validation in CleverControl Installer Allows Remote Code Execution
- State
- Published
- Severity
- 6.5 Medium
- Published
- Sep 23, 2025
- Updated
- Nov 3, 2025
- Reserved
- Sep 16, 2025
Description
The CleverControl employee monitoring software (v11.5.1041.6) fails to validate TLS server certificates during the installation process. The installer downloads and executes external components using curl.exe --insecure, enabling a man-in-the-middle attacker to deliver malicious files that are executed with SYSTEM privileges. This can lead to full remote code execution with administrative rights. No patch is available as the vendor has been unresponsive. It is assumed that previous versions are also affected, but this is not confirmed.
Scores
| CVSS | Score | Vector | Source |
|---|---|---|---|
| 3.1 | 6.5 Medium | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:L | CISA-ADP |
Weaknesses
- CWE-295 Improper Certificate Validation
Affected Products
| Product | Versions |
|---|---|
CleverControl employee monitoring softwareCleverControl |
|
References
Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.