CVE-2025-13833

Received Received - Intake

SecureConnector for Windows Command Injection Vulnerability

Publication date: 2026-10-26

Last updated on: 2026-10-26

Assigner: Forescout

Description

A vulnerability exists in SecureConnector for Windows when the “Additional Appliance Connections” setting is enabled and the agent’s configuration file contains more than three trusted‑server entries. Some entries omit TLS certificate fingerprints, which allows the agent to accept and establish sessions with a malicious server. An attacker who controls the wired or wireless network can redirect traffic to a malicious server. The attacker can then use the agent’s built‑in command/file features to execute arbitrary commands as SYSTEM, granting full administrative control and the ability to disable endpoint protections or exfiltrate data.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-10-26

Last Modified

2026-10-26

Generated

2026-10-27

AI Q&A

2026-10-27

EPSS Evaluated

N/A

NVD

CVE-2025-13833

EUVD

EUVD-2025-211200

Affected Vendors & Products

Vendor	Product	Version / Range
Forescout Technologies	SecureConnector	0

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-295	The product does not validate, or incorrectly validates, a certificate.

Attack-Flow Graph

Executive Summary

This vulnerability affects SecureConnector for Windows when the 'Additional Appliance Connections' setting is enabled and the agent’s configuration file has more than three trusted-server entries. Some entries lack TLS certificate fingerprints, allowing the agent to connect to malicious servers. Attackers on the same network can redirect traffic to these servers and execute arbitrary commands as SYSTEM, gaining full control over the system.

Detection Guidance

Check the SecureConnector configuration file for more than three trusted-server entries with missing TLS certificate fingerprints. Inspect network traffic for unexpected server redirections or unauthorized command execution attempts.

Impact Analysis

An attacker could intercept your network traffic, execute malicious commands on your system with SYSTEM privileges, disable security protections, or steal sensitive data. This could lead to complete system compromise, unauthorized access, or data breaches.

Compliance Impact

This vulnerability could lead to unauthorized access, data exfiltration, or system compromise, violating GDPR (data protection) and HIPAA (health data security) requirements. Non-compliance may result in legal penalties, fines, or reputational damage.

Mitigation Strategies

Disable the 'Additional Appliance Connections' setting in SecureConnector. Ensure all trusted-server entries include valid TLS certificate fingerprints. Monitor network traffic for suspicious activity and restrict administrative access.

Hi! I’m here to help you understand CVE-2025-13833. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70