What is the CVSS score of CVE-2025-56231?

CVE-2025-56231 has a CVSS 3.1 base score of 9.1 (Critical). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N. EPSS exploitation probability: 0.0%.

Which versions of Internet Download Manager are affected by CVE-2025-56231?

CVE-2025-56231 presents critical security risk rated CVSS 9.1. Successful exploitation could critically impact the confidentiality, integrity, and availability of affected systems.

Is there a public PoC exploit available for CVE-2025-56231?

Yes, a public proof-of-concept exploit is available for CVE-2025-56231. Prioritise patching immediately. EPSS: 0.0%.

How to fix or mitigate CVE-2025-56231?

Within 24 hours: Identify all affected systems and apply vendor patches immediately. Monitor vendor channels for patch availability.

Internet Download Manager CVE-2025-56231

CRITICAL

Improper Certificate Validation (CWE-295)

2025-11-05 cve@mitre.org

Authentication Bypass Internet Download Manager Tonec

9.1

CVSS 3.1 · Vendor: mitre

Severity by source

Vendor (mitre) PRIMARY

9.1 CRITICAL

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N

Primary rating from Vendor (mitre) · only source for this CVE.

CVSS VectorVendor: mitre

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

None

Lifecycle Timeline

Analysis Generated

Mar 28, 2026 - 19:20 vuln.today

PoC Detected

Jan 07, 2026 - 20:58 vuln.today

Public exploit code

CVE Published

Nov 05, 2025 - 18:15 nvd

CRITICAL 9.1

DescriptionCVE.org

Tonec Internet Download Manager 6.42.41.1 and earlier suffers from Missing SSL Certificate Validation, which allows attackers to bypass update protections.

AnalysisAI

Tonec Internet Download Manager 6.42.41.1 and earlier suffers from Missing SSL Certificate Validation, which allows attackers to bypass update protections. Rated critical severity (CVSS 9.1), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.

Technical ContextAI

This vulnerability is classified under CWE-295. Tonec Internet Download Manager 6.42.41.1 and earlier suffers from Missing SSL Certificate Validation, which allows attackers to bypass update protections. Affected products include: Tonec Internet Download Manager.

RemediationAI

No vendor patch is available at time of analysis. Monitor vendor advisories for updates. Apply vendor patches when available. Implement network segmentation and monitoring as interim mitigations.