In the ConnectWise Automate Agent, communications could be configured to use HTTP instead of HTTPS. In such cases, an on-path threat actor with a man-in-the-middle network position could intercept, modify, or replay agent-server traffic. Additionally, the encryption method used to obfuscate some communications over the HTTP channel is updated in the Automate 2025.9 patch to enforce HTTPS for all agent communications.
References
| Link | Resource |
|---|---|
| https://www.connectwise.com/company/trust/security-bulletins/connectwise-automate-2025.9-security-fix | Vendor Advisory |
Configurations
History
29 Oct 2025, 19:33
| Type | Values Removed | Values Added |
|---|---|---|
| References | () https://www.connectwise.com/company/trust/security-bulletins/connectwise-automate-2025.9-security-fix - Vendor Advisory | |
| CPE | cpe:2.3:a:connectwise:automate:*:*:*:*:*:*:*:* | |
| First Time |
Connectwise automate
Connectwise |
16 Oct 2025, 19:15
| Type | Values Removed | Values Added |
|---|---|---|
| New CVE |
Information
Published : 2025-10-16 19:15
Updated : 2025-10-29 19:33
NVD link : CVE-2025-11492
Mitre link : CVE-2025-11492
CVE.ORG link : CVE-2025-11492
JSON object : View
Products Affected
connectwise
- automate
CWE
CWE-319
Cleartext Transmission of Sensitive Information