Hardcoded AES Key Vulnerability in ConnectWise Risk Assessment Tool

CVE-2025-4876

What is CVE-2025-4876?

The ConnectWise Risk Assessment tool contains a vulnerability that allows an attacker to extract a hardcoded AES decryption key directly from the binary file. This key, stored in plaintext, is used for cryptographic functions without implementing dynamic key management. Once the key is compromised, it can be utilized to decrypt sensitive CSV files involved in authenticated network scanning, potentially exposing confidential information.

References