---
id: "CVE-2025-13833"
kind: "vulnerability"
aliases: ["CVE-2025-13833"]
title: "SecureConnector for Windows: missing TLS fingerprints let attackers run SYSTEM commands"
severity: "high"
cvss: 7.7
epss: null
exploited: false
status: "open"
category: "vendor"
products: []
ecosystems: []
tags: ["endpoint-management", "securconnector", "vendor", "windows"]
not_affected_if: ["default-config", "fingerprints-on-all-entries"]
published_at: "2026-10-26T21:17:01+00:00"
first_seen_at: "2026-10-26T21:20:24+00:00"
updated_at: "2026-10-26T21:21:09+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-13833", "first_seen_at": "2026-10-26T21:20:24+00:00"}]
---

# SecureConnector for Windows: missing TLS fingerprints let attackers run SYSTEM commands

SecureConnector for Windows accepts sessions with a malicious server when the Additional Appliance Connections setting is enabled and some trusted-server entries lack TLS certificate fingerprints. An attacker on the wired or wireless network who redirects traffic to such a server can use the agent's built-in command and file features to run arbitrary commands as SYSTEM.

_Summary, check and fix written by a model from the sources; labelled as such._

## How to check

- Check whether the 'Additional Appliance Connections' setting is enabled in the SecureConnector configuration.
- Inspect the agent's configuration file for more than three trusted-server entries, and check whether any entry lacks a TLS certificate fingerprint.
- Confirm the installed SecureConnector version against the vendor advisory: unknown

## Fix

- Update SecureConnector for Windows to a fixed version: unknown
- Add TLS certificate fingerprints to every trusted-server entry, or disable 'Additional Appliance Connections' until patched: unknown

## Timeline

- 2026-10-26T21:20:24+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2025-13833

## From the sources

A vulnerability exists in SecureConnector for Windows when the “Additional Appliance Connections” setting is enabled and the agent’s configuration file contains more than three trusted‑server entries. Some entries omit TLS certificate fingerprints, which allows the agent to accept and establish sessions with a malicious server. An attacker who controls the wired or wireless network can redirect traffic to a malicious server. The attacker can then use the agent’s built‑in command/file features to execute arbitrary commands as SYSTEM, granting full administrative control and the ability to disable endpoint protections or exfiltrate data.

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_