Cyber Resilience

CVE-2025-56230

Tencent Docs ≤ 3.9.20

Public PoC
Published
04 November 2025
Modified
10 February 2026
CVSS Score v3.1 7.5
Click a component to see what it means
Raw vectorCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
EPSS Score 0.0022 12th percentile
Risk Priority 56 floored blend · peak EPSS

Summary

CVE-2025-56230 is a high-severity Missing Validation of OpenSSL Certificate (CWE-599) vulnerability in Tencent Docs. Its CVSS base score is 7.5 (High).

Operationally, exploitation aligns with the MITRE ATT&CK technique Adversary-in-the-Middle (T1557); ranked at the 12th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog; a public proof-of-concept is referenced.

The strongest mitigations our analysis identified map to IA-5 (Authenticator Management) and SA-8 (Security and Privacy Engineering Principles) — see the control section below for these in your framework.

EU & UK References

Vulnerability Data

Tencent Docs Desktop 3.9.20 and earlier suffers from Missing SSL Certificate Validation in the update component.

CWE(s)
CWE-599

Related Threats

MITRE ATT&CK Enterprise Techniques

T1557 Adversary-in-the-Middle Credential Access
Adversaries may attempt to position themselves between two or more networked devices using an adversary-in-the-middle (AiTM) technique to support follow-on behaviors such as [Network Sniffing](https://attack.
attack.mitre.org →
T1557.002 ARP Cache Poisoning Credential Access
Adversaries may poison Address Resolution Protocol (ARP) caches to position themselves between the communication of two or more networked devices.
attack.mitre.org →
T1557.003 DHCP Spoofing Credential Access
Adversaries may redirect network traffic to adversary-owned systems by spoofing Dynamic Host Configuration Protocol (DHCP) traffic and acting as a malicious DHCP server on the victim network.
attack.mitre.org →
T1557.004 Evil Twin Credential Access
Adversaries may host seemingly genuine Wi-Fi access points to deceive users into connecting to malicious networks as a way of supporting follow-on behaviors such as [Network Sniffing](https://attack.
attack.mitre.org →
Derived from this CVE’s CWE(s) via the direct CWE→ATT&CK cross-walk.

CVEs Like This One

CVE-2025-63432Shared CWE-599
CVE-2025-12553Shared CWE-599
CVE-2024-41265Shared CWE-599
CVE-2024-36755Shared CWE-599
CVE-2026-25060Shared CWE-599
CVE-2025-56146Shared CWE-599
CVE-2026-62657Shared CWE-599
CVE-2024-41253Shared CWE-599
CVE-2025-56232Shared CWE-599
CVE-2024-40464Shared CWE-599

Affected Assets

tencent
docs
≤ 3.9.20

Mitigating Controls

Control response

Prevent
Stop it (NIST 800-53)

—

Detect
Catch it (NIST detect / respond)

—

Harden
Shrink the surface (DISA STIG)

—

Validate
Prove the fix (OWASP ASVS)
  • V12.3.5
  • V17.2.8

Mitigating Controls (NIST 800-53 r5) AI

IA-5 Authenticator Management partial match

Authenticator management requires verification of certificate identity and revocation status before use, directly stopping acceptance of unvalidated OpenSSL certificates.

SA-8 Security and Privacy Engineering Principles partial match

Security engineering principles require correct implementation of cryptographic authentication mechanisms including certificate validation.

SC-8 Transmission Confidentiality and Integrity partial match

Requiring cryptographic integrity protection for transmitted data forces proper certificate validation to establish trusted channels.

Mitigating Controls (NIST CSF 2.0) AI

Derived directly from the weakness types (CWEs) cited in the NVD entry via our AI-authored CWE→CSF cross-walk (authority under review) — links open the control.

PR.DS-02 full match
prevents

Proper data-in-transit protection via TLS requires certificate validation with SSL_get_verify_result().

PR.PS-06 mostly match
prevents

Secure development practices include implementing correct OpenSSL certificate validation during coding.

PR.AA-03 partial match
prevents

Service and hardware authentication depends on valid certificates, but the control is broader than TLS validation.

Mitigating Controls (ISO/IEC 27001:2022 Annex A) AI

Derived directly from the weakness types (CWEs) cited in the NVD entry via our AI-authored CWE→ISO cross-walk (authority under review) — links open the control.

A.8.29 Security testing in development and acceptance mostly match
finds

Security testing could detect missing certificate validation but does not prevent the weakness at development time.

A.8.24 Use of cryptography partial match
prevents

Mandates proper use of cryptography including certificate validation, directly addressing the missing SSL_get_verify_result() check.

A.8.26 Application security requirements partial match
prevents

Application security requirements may specify certificate validation but do not mandate the specific OpenSSL API usage.

A.8.28 Secure coding partial match
prevents

Requires secure coding practices that would include proper certificate validation in OpenSSL usage.

References