CVE-2025-4876
📋 TL;DR
This vulnerability allows attackers to extract a hardcoded AES decryption key from ConnectWise Risk Assessment's password encryption utility via reverse engineering. The key can then decrypt CSV files used for authenticated network scanning, potentially exposing sensitive network credentials. Organizations using ConnectWise Risk Assessment with the vulnerable utility are affected.
💻 Affected Systems
- ConnectWise Risk Assessment
📦 What is this software?
Risk Assessment by Connectwise
⚠️ Risk & Real-World Impact
Worst Case
Attackers decrypt CSV files containing network credentials, gain authenticated access to internal systems, and potentially move laterally across the network.
Likely Case
Attackers extract the hardcoded key and decrypt CSV files to obtain network scanning credentials, compromising the security of scanned systems.
If Mitigated
With proper network segmentation and credential rotation, impact is limited to exposure of specific scanning credentials rather than broader network compromise.
🎯 Exploit Status
Exploitation requires access to the binary file and basic reverse engineering skills to extract the hardcoded key.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: Not available
Vendor Advisory: Not available
Restart Required: No
Instructions:
1. Contact ConnectWise for updated utility version
2. Replace ConnectWise-Password-Encryption-Utility.exe with patched version
3. Rotate all credentials stored in previously encrypted CSV files
🔧 Temporary Workarounds
Disable vulnerable utility
windowsStop using ConnectWise-Password-Encryption-Utility.exe for CSV file decryption
Implement external key management
allReplace hardcoded key with external key management system
🧯 If You Can't Patch
- Restrict access to ConnectWise-Password-Encryption-Utility.exe binary files
- Rotate all credentials that were ever processed through the vulnerable utility
🔍 How to Verify
Check if Vulnerable:
Check if ConnectWise-Password-Encryption-Utility.exe exists on system and contains hardcoded AES key via strings analysisCheck Version:
Not applicable - check binary properties or contact vendorVerify Fix Applied:
Verify new utility version uses dynamic key management or external key storage📡 Detection & Monitoring
Log Indicators:
- Unauthorized access attempts to CSV files
- Unusual network scanning activity from unexpected sources
Network Indicators:
- Unexpected authenticated scanning from unauthorized IPs
- Credential reuse across multiple systems
SIEM Query:
source="*csv*" AND action="decrypt" AND user!="authorized_user"