CVE-2025-4876
Hardcoded Key Revealed in ConnectWise Password Encryption Utility
- State
- Published
- Severity
- 6.0 Medium
- Published
- May 19, 2025
- Updated
- Sep 3, 2025
- Reserved
- May 16, 2025
Description
ConnectWise-Password-Encryption-Utility.exe in ConnectWise Risk Assessment allows an attacker to extract a hardcoded AES decryption key via reverse engineering. This key is embedded in plaintext within the binary and used in cryptographic operations without dynamic key management. Once obtained the key can be used to decrypt CSV input files used for authenticated network scanning.
Scores
| CVSS | Score | Vector | Source |
|---|---|---|---|
| 3.1 | 6.0 Medium | CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:C/C:H/I:N/A:N | ConnectWise |
Weaknesses
- CWE-321 Use of Hard-coded Cryptographic Key
Affected Products
| Product | Versions |
|---|---|
Risk AssessmentConnectWise |
|
References
Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.