CVE-2025-56231
CriticalCVSS 9.1Exploitation Probability (EPSS)
Low risk13th percentile - higher than 13% of all known CVEs
Summary
Tonec Internet Download Manager 6.42.41.1 and earlier fails to validate SSL certificates, allowing attackers to bypass update protections.
Risk Assessment
An attacker can intercept and replace software updates, installing malware instead of legitimate patches, leading to system compromise.
Recommendation
Immediately update Internet Download Manager to the latest available version that includes the SSL certificate validation fix.
Other vulnerabilities in Internet Download Manager
See all- CVE-2026-90493High
A vulnerability was detected in Tonec Internet Download Manager up to 6.42 Build 63 on Windows. The kernel driver idmwfp.sys exposes the \\.\IDMWFP device interface to authenticated local users with an access control descriptor equivalent to D:P(A;;GA;;;AU), and its IOCTL 0x12C028 handler does not authenticate the caller or restrict operations to IDM-owned registry namespaces. This allows a low-privileged local authenticated user to read, create, modify, and delete arbitrary registry values under HKLM and HKU.
- CVE-2020-37234Medium
Internet Download Manager 6.38.12 contains a buffer overflow vulnerability in the Scheduler component that allows local attackers to crash the application by supplying oversized input. Attackers can paste malicious data exceeding 5000 bytes into the 'Open the following file when done' field to trigger a denial of service condition.
Original NVD description (English source)
Tonec Internet Download Manager 6.42.41.1 and earlier suffers from Missing SSL Certificate Validation, which allows attackers to bypass update protections.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS