Loading vulnerability…
CVE-2025-11492 affects the ConnectWise Automate Agent when agent communications are configured to use HTTP rather than HTTPS. In that configuration, agent-server traffic is transmitted over an unencrypted channel susceptible to interception and manipulation by an attacker in an on-path man-in-the-middle position. The vendor also notes that some communications over the HTTP channel were only obfuscated with an encryption method that is being updated in Automate 2025.9, and the patch enforces HTTPS for all agent communications. The core issue is the use of cleartext/inadequately protected transport for sensitive agent-server communications, enabling interception, modification, or replay of traffic.
Mallory correlates every CVE against your assets, your vendors, and active adversary campaigns. Know which vulnerabilities matter for you, not just which ones are loud.
What it means. What to do now. Patch path, mitigations, and the assume-compromise checklist.
What an attacker gets, and what they’ve been doing with it.
If you can’t patch tonight, do this now.
Patch, then assume compromise.
1 valid exploit after Mallory filtered fakes, detection scripts, and README-only repos.
This repository implements a full adversary-in-the-middle (AiTM) exploit for ConnectWise Automate (LabTech) agent vulnerabilities (CVE-2025-11492, CVE-2025-11493). The exploit targets agents configured to use HTTP (unencrypted) communication, allowing an attacker with network access to impersonate the legitimate Automate server and deliver a malicious plugin to the agent. The repository is structured as follows: - The main exploit logic is in `automate_server/main.py`, which implements a FastAPI server emulating the Automate server endpoints. It handles the agent's dependency checks, serves a malicious plugin DLL, and manages command-and-control (C2) operations. - `automate_server/labtech_enums.py` and `labtech_net.py` provide enum mappings and .NET interop for agent command IDs and encryption routines. - `automate_server/deps_LabTech_Agent_v250.249.xml` is a sample dependency list used to trigger plugin updates. - `mitm_automate.py` is a mitmproxy script to redirect agent traffic from the real Automate server to the attacker's server. - The exploit flow is multi-stage: (1) The agent is tricked into downloading a malicious plugin, (2) the plugin exfiltrates credentials to the attacker's `/pwned` endpoint, (3) the attacker can then send arbitrary commands to the agent, including cleanup and persistence actions. - The default payload demonstrates code execution by running a ping command, but the infrastructure supports arbitrary command execution and further post-exploitation. The exploit is operational and demonstrates real-world attack capability, including credential theft and remote code execution. It requires the attacker to be in a network position to intercept or redirect agent traffic (e.g., via ARP spoofing, DNS poisoning, or local access). The repository is well-documented and modular, supporting further extension for other attack scenarios.
Products and vendors Mallory has correlated with this vulnerability. Open in Mallory to drill down to specific CPE configurations and version ranges.
Vendor-confirmed product mapping. Mallory continuously reconciles this list against your asset inventory.
10 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.
Query your assets running an affected version, and investigate the blast radius.
Every observed campaign linking this CVE to a named adversary.
Malware families riding this exploit, with evidence and IOCs.
YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.
Cross-references every affected SKU, including bundled OEM variants.
Community discussion across Reddit, Mastodon, and other social sources.