CVE-2022-36781: ConnectWise ScreenConnect versions 22.6 and below contained a flaw allowing potential brute force attacks on custom access tokens due to inadequate…

PriorityP429medium5.3CVSS 3.1

AVNACLPRNUINSUCLINAN

EPSS

0.46%

36.3th percentile

ConnectWise ScreenConnect versions 22.6 and below contained a flaw allowing potential brute force attacks on custom access tokens due to inadequate rate-limiting controls in the default configuration. Attackers could exploit this vulnerability to gain unauthorized access by repeatedly attempting access code combinations. ConnectWise has addressed this issue in later versions by implementing rate-limiting controls as a preventive measure against brute force attacks.

Affected

2 ranges

Vendor	Product	Version range	Fixed in
connectwise	screenconnect	< 22.7	22.7
connectwise	screenconnect	>= 22.7 < 22.6*	22.6*

Stop checking back — get the weekly exploitation signal.

Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.