Executive brief
Tonec Internet Download Manager, a popular tool for managing and accelerating file downloads, contains a security flaw in how it verifies software updates. Because the application fails to properly validate security certificates, an attacker could intercept the update process and trick the software into installing malicious files instead of legitimate updates. This could lead to a full system compromise or the installation of malware on the user's computer.
Technical details
Internet Download Manager (IDM) versions 6.42.41.1 and earlier fail to perform proper SSL/TLS certificate validation (CWE-295) during the update check and retrieval process. A remote attacker positioned on the network (e.g., via Man-in-the-Middle) can intercept the communication between the client and the update server. By presenting a forged certificate that the application fails to reject, the attacker can bypass update protections and deliver malicious payloads disguised as legitimate software updates. This vulnerability is exploitable without authentication and requires no user interaction beyond the application's standard update routine.
Affected products
- Tonec Internet Download Manager Up to and including 6.42.41.1
Timeline
- 2025-11-05: disclosed
- 2025-11-05: advisory