Forescout SecureConnector CVE-2025-13833

Exploitation requires a non-default configuration: the 'Additional Appliance Connections' setting must be enabled AND the agent's configuration file must contain more than three trusted-server entries, where at least some entries omit TLS certificate fingerprints - that missing-fingerprint condition is what lets the agent accept a malicious server. The attacker must also hold an adjacent-network position (control of the victim's wired or wireless network) to redirect/MITM the agent's traffic; this is not remote-over-the-internet exploitation. Per the CVSS vector (PR:N) the attack is unauthenticated and needs no user interaction, but the adjacency requirement and the specific multi-trusted-server misconfiguration substantially limit who can realistically trigger it. Affects SecureConnector versions ≤11.3.20.

Signals conflict in a way that pulls this below its headline CVSS 7.7. The CVSS 4.0 vector (AV:A/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H) shows unauthenticated adjacent-network attack with total confidentiality, integrity and availability impact - SYSTEM-level command execution - which is genuinely severe. However, AT:P signals that a specific attack requirement must hold (the non-default trusted-server configuration), so exploitation is NOT automatable or widely sprayable. This is corroborated by EPSS of 0.15% (4th percentile), indicating very low predicted exploitation probability, and there is no CISA KEV listing and no public exploit identified at time of analysis. The practical gating factors - attacker must already hold an adjacent wired/wireless position AND the agent must run a non-default config with more than three trusted-server entries, some lacking TLS fingerprints - make this a targeted, conditions-dependent issue rather than a mass-exploitation threat. The vuln.today Decision label is 'this_week', consistent with a real but non-emergency priority: plan remediation within the week rather than treat it as an active-exploitation fire drill. In short, a legitimately high-impact flaw whose real-world risk is constrained by adjacency and a specific misconfiguration, not a high-CVSS-but-hollow finding, but also not an emergency.

An attacker who has gained a position on the victim's wired or wireless network (for example via a rogue access point or on-path redirection) causes the SecureConnector agent's traffic to be redirected to an attacker-controlled appliance. Because the agent is configured with 'Additional Appliance Connections' and its config lists more than three trusted servers where some entries omit TLS certificate fingerprints, the agent accepts a TLS session with the malicious server and the attacker invokes the agent's built-in command/file features to run arbitrary commands as SYSTEM. No public exploit has been identified at time of analysis.