---
id: CVE-2025-10548
title: >-
  The CleverControl employee monitoring software (v11.5.1041.6) fails to
  validate TLS server certificates during the installation process
summary: >-
  The CleverControl employee monitoring software (v11.5.1041.6) fails to
  validate TLS server certificates during the installation process. The
  installer downloads and executes external components using curl.exe
  --insecure, enabling a man-i…
severity: medium
cvss: 6.5
cvssVector: 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:L'
cwe:
  - CWE-295
published: '2025-09-23'
updated: '2026-10-11'
sourceUpdated: '2026-10-11T20:10:00.200'
source: NVD
sourceUrl: 'https://nvd.nist.gov/vuln/detail/CVE-2025-10548'
references:
  - url: 'https://r.sec-consult.com/clevercontrol'
    label: 551230f0-3615-47bd-b7cc-93e92e730bbf
  - url: 'http://seclists.org/fulldisclosure/2025/Sep/71'
    label: af854a3a-2127-422b-91ae-364da2661108
tags:
  - nvd
epss: 0.00377
epssPercentile: 0.29657
ingestedAt: '2026-10-12T14:50:33.978Z'
---

## Overview

The CleverControl employee monitoring software (v11.5.1041.6) fails to validate TLS server certificates during the installation process. The installer downloads and executes external components using curl.exe --insecure, enabling a man-in-the-middle attacker to deliver malicious files that are executed with SYSTEM privileges. This can lead to full remote code execution with administrative rights. No patch is available as the vendor has been unresponsive. It is assumed that previous versions are also affected, but this is not confirmed.

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.