CVE-2025-70043
Published: 23 February 2026
Summary
CVE-2025-70043 is a critical-severity Improper Certificate Validation (CWE-295) vulnerability. Its CVSS base score is 9.1 (Critical).
Operationally, exploitation aligns with the MITRE ATT&CK technique Adversary-in-the-Middle (T1557); ranked at the 6.9th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.
The strongest mitigations our analysis identified are NIST 800-53 SC-17 (Public Key Infrastructure Certificates) and SC-8 (Transmission Confidentiality and Integrity).
Threat & Defense at a Glance
Threat & Defense Details
Mitigating Controls (NIST 800-53 r5)AI
Requires validation and management of public key infrastructure certificates, directly preventing acceptance of invalid or untrusted certificates in TLS connections exploited by this CVE.
Mandates cryptographic protection for transmission confidentiality and integrity, which comprehensively addresses the improper TLS certificate validation enabling MITM attacks.
Requires identification, reporting, and timely remediation of system flaws, directly mitigating the hardcoded 'rejectUnauthorized: false' vulnerability in the Node.js application.
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
Directly enables MITM attacks via disabled TLS certificate validation (CWE-295).
NVD Description
An issue pertaining to CWE-295: Improper Certificate Validation was discovered in Ayms node-To master. The application disables TLS/SSL certificate validation by setting 'rejectUnauthorized': false in TLS socket options
Deeper analysisAI
CVE-2025-2025-70043, published on 2026-02-23, is a critical vulnerability (CVSS 9.1, CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N) corresponding to CWE-295: Improper Certificate Validation in the master branch of Ayms node-To. This Node.js application or module, hosted under the Ayms GitHub organization, disables TLS/SSL certificate validation by explicitly setting the 'rejectUnauthorized' option to false in its TLS socket configurations, allowing connections to servers with invalid or untrusted certificates.
The vulnerability enables remote attackers with network access to exploit it with low complexity, no required privileges, and no user interaction. Exploitation facilitates man-in-the-middle attacks, granting high confidentiality and integrity impacts, such as intercepting sensitive data in transit or injecting malicious content into otherwise encrypted communications.
Mitigation details are available in the referenced sources, including the GitHub repositories at https://github.com/Ayms and https://github.com/Ayms/node-To, as well as the advisory gist at https://gist.github.com/zcxlighthouse/33cc4342dfe650664548b4531d16b655.
Details
- CWE(s)