Vulnerability · Published Sep 23, 2025 · Assigned by SEC-VLab
CVE-2025-10548Missing Certificate Validation in CleverControl Installer Allows Remote Code Execution
Medium 6.5
In plain English
A medium-severity improper certificate validation in CleverControl employee monitoring software from CleverControl. Proof-of-concept exploit code is public. The chance it is exploited in the next 30 days is estimated at 0.4% (higher than 34% of all known vulnerabilities).
Official description
The CleverControl employee monitoring software (v11.5.1041.6) fails to validate TLS server certificates during the installation process. The installer downloads and executes external components using curl.exe --insecure, enabling a man-in-the-middle attacker to deliver malicious files that are executed with SYSTEM privileges. This can lead to full remote code execution with administrative rights. No patch is available as the vendor has been unresponsive. It is assumed that previous versions are also affected, but this is not confirmed.
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| CleverControl | CleverControl employee monitoring software | 11.5.1041.6 |
Weakness: CWE-295 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:L