CVE-2025-4876

{"id": "CVE-2025-4876", "cveTags": [], "metrics": {"cvssMetricV31": [{"type": "Secondary", "source": "7d616e1a-3288-43b1-a0dd-0a65d3e70a49", "cvssData": {"scope": "CHANGED", "version": "3.1", "baseScore": 6.0, "attackVector": "LOCAL", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:C/C:H/I:N/A:N", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "HIGH", "confidentialityImpact": "HIGH"}, "impactScore": 4.0, "exploitabilityScore": 1.5}]}, "published": "2025-05-19T16:15:35.107", "references": [{"url": "https://github.com/packetlabs/vulnerability-advisory/blob/main/Disclosures/PL-2025-11315/README.md", "source": "7d616e1a-3288-43b1-a0dd-0a65d3e70a49"}], "vulnStatus": "Awaiting Analysis", "weaknesses": [{"type": "Secondary", "source": "7d616e1a-3288-43b1-a0dd-0a65d3e70a49", "description": [{"lang": "en", "value": "CWE-798"}]}], "descriptions": [{"lang": "en", "value": "ConnectWise-Password-Encryption-Utility.exe in ConnectWise Risk Assessment allows an attacker to extract a hardcoded AES decryption key via reverse engineering. This key is embedded in plaintext within the binary and used in cryptographic operations without dynamic key management. Once obtained the key can be used to decrypt CSV input files\u00a0used for authenticated network scanning."}, {"lang": "es", "value": "ConnectWise-Password-Encryption-Utility.exe, en la Evaluaci\u00f3n de Riesgos de ConnectWise, permite a un atacante extraer una clave de descifrado AES codificada mediante ingenier\u00eda inversa. Esta clave se incrusta en texto plano dentro del binario y se utiliza en operaciones criptogr\u00e1ficas sin gesti\u00f3n din\u00e1mica de claves. Una vez obtenida, la clave puede utilizarse para descifrar archivos CSV de entrada utilizados para el escaneo de red autenticado."}], "lastModified": "2025-05-21T20:25:16.407", "sourceIdentifier": "7d616e1a-3288-43b1-a0dd-0a65d3e70a49"}