Medium severity6.0NVD Advisory· Published May 19, 2025· Updated Jun 17, 2026
CVE-2025-4876
CVE-2025-4876
Description
ConnectWise-Password-Encryption-Utility.exe in ConnectWise Risk Assessment allows an attacker to extract a hardcoded AES decryption key via reverse engineering. This key is embedded in plaintext within the binary and used in cryptographic operations without dynamic key management. Once obtained the key can be used to decrypt CSV input files used for authenticated network scanning.
AI Insight
LLM-synthesized narrative grounded in this CVE's description and references.
Affected products
3cpe:2.3:a:connectwise:risk_assessment:*:*:*:*:*:*:*:*+ 1 more
- cpe:2.3:a:connectwise:risk_assessment:*:*:*:*:*:*:*:*range: <2023-07-01
- (no CPE)range: All versions prior to deprecation (July 2023)
Patches
Vulnerability mechanics
References
1- github.com/packetlabs/vulnerability-advisory/blob/main/Disclosures/PL-2025-11315/README.mdnvdThird Party Advisory
News mentions
0No linked articles in our index yet.