VulnCheck KEV: CVE-2024-1709

ConnectWise ScreenConnect contains an authentication bypass vulnerability that allows an attacker with network access to the management interface to create a new, administrator-level account on affected devices...

ConnectWise ScreenConnect Unauthenticated Remote Code Execution

This module exploits an authentication bypass vulnerability that allows an unauthenticated attacker to create a new administrator user account on a vulnerable ConnectWise ScreenConnect server. The attacker can leverage this to achieve RCE by uploading a malicious extension module. All versions of...

CVE-2023-47256

ConnectWise ScreenConnect through 23.8.4 allows local users to connect to arbitrary relay servers via implicit trust of proxy settings...

CVE-2023-47257

ConnectWise ScreenConnect through 23.8.4 allows man-in-the-middle attackers to achieve remote code execution via crafted messages...

CVE-2023-47256

ConnectWise ScreenConnect through 23.8.4 allows local users to connect to arbitrary relay servers via implicit trust of proxy settings...

CVE-2023-47257

ConnectWise ScreenConnect through 23.8.4 allows man-in-the-middle attackers to achieve remote code execution via crafted messages...

Remote code execution

ConnectWise ScreenConnect through 23.8.4 allows man-in-the-middle attackers to achieve remote code execution via crafted messages...

Code injection

ConnectWise ScreenConnect through 23.8.4 allows local users to connect to arbitrary relay servers via implicit trust of proxy settings...

CVE-2023-47257

ConnectWise ScreenConnect through 23.8.4 allows man-in-the-middle attackers to achieve remote code execution via crafted messages...

CVE-2023-47256

ConnectWise ScreenConnect through 23.8.4 allows local users to connect to arbitrary relay servers via implicit trust of proxy settings...

CVE-2023-47257: Improper Control of Generation of Code

ConnectWise ScreenConnect through 23.8.4 allows man-in-the-middle attackers to achieve remote code execution via crafted messages...

CVE-2023-47256: Improper Authentication

ConnectWise ScreenConnect through 23.8.4 allows local users to connect to arbitrary relay servers via implicit trust of proxy settings...

PT-2024-13433 · Connectwise · Connectwise Screenconnect

Name of the Vulnerable Software and Affected Versions: ConnectWise ScreenConnect versions through 23.8.4 Description: The issue allows man-in-the-middle attackers to achieve remote code execution via crafted messages. Recommendations: For ConnectWise ScreenConnect versions through 23.8.4, update ...

CVE-2023-47257

ConnectWise ScreenConnect through 23.8.4 allows man-in-the-middle attackers to achieve remote code execution via crafted messages...

CVE-2023-47256

ConnectWise ScreenConnect through 23.8.4 allows local users to connect to arbitrary relay servers via implicit trust of proxy settings...

ConnectWise ScreenConnect Security Breach

ConnectWise ScreenConnect is a self-hosted remote desktop software application from ConnectWise. A security vulnerability exists in ConnectWise ScreenConnect version 23.8.4 and prior versions that originates from a vulnerability that allows a man-in-the-middle attacker to achieve remote code...

PT-2024-13432 · Connectwise · Connectwise Screenconnect

Name of the Vulnerable Software and Affected Versions: ConnectWise ScreenConnect versions through 23.8.4 Description: The issue allows local users to connect to arbitrary relay servers via implicit trust of proxy settings. Recommendations: For ConnectWise ScreenConnect versions through 23.8.4, as...

CVE-2023-47257

CVE-2023-47257 affects ConnectWise ScreenConnect up to version 23.8.4. A remote code execution vulnerability can be leveraged by crafting messages, with a network attack vector, no privileges required, and high impact on confidentiality, integrity, and availability. Remediation is referenced in C...

CVE-2023-47256

ConnectWise ScreenConnect (ConnectWise Control) versions through 23.8.4 are affected. Local users can connect to arbitrary relay servers due to an implicit trust of proxy settings, exposing potential bypass of proxy controls and related security boundaries. The vulnerability description is suppor...

Iran's MuddyWater Targets Israel in New Spear-Phishing Cyber Campaign

The Iranian nation-state actor known as MuddyWater has been linked to a new spear-phishing campaign targeting two Israeli entities to ultimately deploy a legitimate remote administration tool from N-able called Advanced Monitoring Agent. Cybersecurity firm Deep Instinct, which disclosed details o...