We use these services and cookies to improve your user experience. You may opt out if you wish, however, this may limit some features on this site.

Please see our statement on Data Privacy.

Crisp.chat (Helpdesk and Chat)

Ok

THREATINT
PUBLISHED

CVE-2025-4876

Hardcoded Key Revealed in ConnectWise Password Encryption Utility



Description

ConnectWise-Password-Encryption-Utility.exe in ConnectWise Risk Assessment allows an attacker to extract a hardcoded AES decryption key via reverse engineering. This key is embedded in plaintext within the binary and used in cryptographic operations without dynamic key management. Once obtained the key can be used to decrypt CSV input files used for authenticated network scanning.

Reserved 2025-05-16 | Published 2025-05-19 | Updated 2025-05-19 | Assigner ConnectWise


MEDIUM: 6.0CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:C/C:H/I:N/A:N

Problem types

CWE-798 Use of Hard-coded Credentials

Product status

Default status
unaffected

All versions prior to deprecation (July 2023)
affected

Credits

Joey Melo (jmelo@packetlabs.net) finder

Ian Lin (ilin@packetlabs.net) finder

References

github.com/.../blob/main/Disclosures/PL-2025-11315/README.md

cve.org (CVE-2025-4876)

nvd.nist.gov (CVE-2025-4876)

Download JSON

Share this page
https://cve.threatint.eu/CVE/CVE-2025-4876

Support options

Helpdesk Chat, Email, Knowledgebase
© Copyright 2025 THREATINT
Made in Cyprus with ❤ + ☼
 System status
Find us on
Data Privacy
Terms of Use
Logo BSI Allianz für Cyber-Sicherheit
Error loading Crisp.chat. Please check your web content filter and browser plugins.