Live › vulnerability › CVE-2025-13833
Go to dashboardSecureConnector for Windows accepts sessions with a malicious server when the Additional Appliance Connections setting is enabled and some trusted-server entries lack TLS certificate fingerprints. An attacker on the wired or wireless network who redirects traffic to such a server can use the agent's built-in command and file features to run arbitrary commands as SYSTEM.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-26 21:20 UTC. All times on this page are UTC.
Windows endpoints running SecureConnector where the Additional Appliance Connections setting is enabled and the configuration file holds more than three trusted-server entries, some without TLS fingerprints. Systems with the setting disabled or with fingerprints on every entry are not described as exposed. Attackers must be able to redirect traffic on the local wired or wireless network.
No product ranges from the sources yet.
Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
A vulnerability exists in SecureConnector for Windows when the “Additional Appliance Connections” setting is enabled and the agent’s configuration file contains more than three trusted‑server entries. Some entries omit TLS certificate fingerprints, which allows the agent to accept and establish sessions with a malicious server. An attacker who controls the wired or wireless network can redirect traffic to a malicious server. The attacker can then use the agent’s built‑in command/file features to execute arbitrary commands as SYSTEM, granting full administrative control and the ability to disable endpoint protections or exfiltrate data.
This page as .md · .json · in your agent: get_signal("CVE-2025-13833")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.