CVE-2023-25719
published 2023-02-13CVE-2023-25719: ConnectWise Control before 22.9.10032 (formerly known as ScreenConnect) fails to validate user-supplied parameters such as the…
PriorityP343high8.8CVSS 3.1
AVNACLPRNUIRSUCHIHAH
EPSS
1.06%
60.5th percentile
ConnectWise Control before 22.9.10032 (formerly known as ScreenConnect) fails to validate user-supplied parameters such as the Bin/ConnectWiseControl.Client.exe h parameter. This results in reflected data and injection of malicious code into a downloaded executable. The executable can be used to execute malicious queries or as a denial-of-service vector. NOTE: this CVE Record is only about the parameters, such as the h parameter (this CVE Record is not about the separate issue of signed executable files that are supposed to have unique configurations across customers' installations).
Affected
1 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| connectwise | control | < 22.9.10032 | 22.9.10032 |
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
No detection rules found.
No public exploits indexed.
No writeups or analysis indexed.
https://cybir.com/2022/cve/hijacking-connectwise-control-and-ddos/https://m.youtube.com/watch?v=fbNVUgmstSc&pp=0gcJCf0Ao7VqN5tDhttps://www.connectwise.com/blog/cybersecurity/the-importance-of-responsible-security-disclosureshttps://cybir.com/2022/cve/hijacking-connectwise-control-and-ddos/https://www.connectwise.comhttps://www.connectwise.com/blog/cybersecurity/the-importance-of-responsible-security-disclosureshttps://www.huntress.com/blog/clearing-the-air-overblown-claims-of-vulnerabilities-exploits-severity
2023-02-13
Published