CVE: TBD
CVSS: 10.00 CRITICAL
CVE: TBD
CVSS: 8.4 HIGH
In the last week, ConnectWise has disclosed vulnerabilities affecting versions 23.9.7 (and older) of its ScreenConnect product.
Two vulnerabilities have been identified and published via a security bulletin on the ConnectWise website. Few details have been published, but the bulletin does indicate the following:
- The first vulnerability allows for authentication bypass by utilisation of an alternate path or channel
- The second vulnerability concerns the improper limitation of a pathname to a restricted directory (AKA “path traversal”)
Utilised together, these vulnerabilities would allow a threat actor to remotely execute code, or directly impact confidential data of critical systems.
ConnectWise is urging all users of ScreenConnect to update to version 23.9.8 to patch these vulnerabilities, but does insist that they have seen no evidence of exploitation in the wild.