CleverControl Employee Monitoring Software Vulnerability

CVE-2025-10548

What is CVE-2025-10548?

The CleverControl Employee Monitoring Software, specifically version 11.5.1041.6, experiences a serious vulnerability due to insufficient validation of TLS server certificates during installation. This flaw allows an attacker to exploit the system by utilizing curl.exe with the '--insecure' option, which ignores certificate validation. Consequently, a man-in-the-middle attack could lead to the delivery and execution of malicious files with SYSTEM privileges, granting full administrative control over the affected system. Current assessments suggest that earlier versions may also be vulnerable, though this has not been confirmed. No patch has been issued, as the vendor has not responded to this critical issue.

References