CVE-2025-56231

Full vulnerability record from the local CVENow database.

Description

Tonec Internet Download Manager 6.42.41.1 and earlier suffers from Missing SSL Certificate Validation, which allows attackers to bypass update protections.

Severity

CRITICAL

CVSS score

9.1 (v3.1)

Vulnerability status

Modified

Source identifier

[email protected]

Published

2025-11-05 18:15:33.637000

Last modified

2026-11-05 14:10:00.273000

View original CVE JSON

{
  "id": "CVE-2025-56231",
  "sourceIdentifier": "[email protected]",
  "published": "2025-11-05T18:15:33.637",
  "lastModified": "2026-11-05T14:10:00.273",
  "vulnStatus": "Modified",
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "Tonec Internet Download Manager 6.42.41.1 and earlier suffers from Missing SSL Certificate Validation, which allows attackers to bypass update protections."
    },
    {
      "lang": "es",
      "value": "Tonec Internet Download Manager 6.42.41.1 y anteriores sufre de Falta de validación de certificado SSL, lo que permite a los atacantes eludir las protecciones de actualización."
    }
  ],
  "affected": [
    {
      "source": "[email protected]",
      "affectedData": [
        {
          "vendor": "n/a",
          "product": "n/a",
          "versions": [
            {
              "version": "n/a",
              "status": "affected"
            }
          ]
        }
      ]
    }
  ],
  "metrics": {
    "cvssMetricV31": [
      {
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "type": "Secondary",
        "cvssData": {
          "version": "3.1",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N",
          "baseScore": 9.1,
          "baseSeverity": "CRITICAL",
          "attackVector": "NETWORK",
          "attackComplexity": "LOW",
          "privilegesRequired": "NONE",
          "userInteraction": "NONE",
          "scope": "UNCHANGED",
          "confidentialityImpact": "HIGH",
          "integrityImpact": "HIGH",
          "availabilityImpact": "NONE"
        },
        "exploitabilityScore": 3.9,
        "impactScore": 5.2
      }
    ],
    "ssvcV203": [
      {
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "ssvcData": {
          "timestamp": "2025-11-05T20:22:41.152206Z",
          "id": "CVE-2025-56231",
          "options": [
            {
              "exploitation": "poc"
            },
            {
              "automatable": "yes"
            },
            {
              "technicalImpact": "partial"
            }
          ],
          "role": "CISA Coordinator",
          "version": "2.0.3"
        }
      }
    ]
  },
  "weaknesses": [
    {
      "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
      "type": "Secondary",
      "description": [
        {
          "lang": "en",
          "value": "CWE-295"
        }
      ]
    }
  ],
  "configurations": [
    {
      "nodes": [
        {
          "operator": "OR",
          "negate": false,
          "cpeMatch": [
            {
              "vulnerable": true,
              "criteria": "cpe:2.3:a:tonec:internet_download_manager:*:*:*:*:*:*:*:*",
              "versionEndIncluding": "6.42.41.1",
              "matchCriteriaId": "F2C16B4D-7D3A-4CC4-86B8-B4599664B7D6"
            }
          ]
        }
      ]
    }
  ],
  "references": [
    {
      "url": "https://www.notion.so/CVE-2025-56231-2a04e9f2a40d80b184f4d02be58d3600",
      "source": "[email protected]",
      "tags": [
        "Exploit",
        "Third Party Advisory"
      ]
    }
  ]
}