module
ConnectWise ScreenConnect Unauthenticated Remote Code Execution
Disclosed |
---|
Feb 19, 2024 |
Disclosed
Feb 19, 2024
Description
This module exploits an authentication bypass vulnerability that allows an unauthenticated attacker to create
a new administrator user account on a vulnerable ConnectWise ScreenConnect server. The attacker can leverage
this to achieve RCE by uploading a malicious extension module. All versions of ScreenConnect version 23.9.7
and below are affected.
a new administrator user account on a vulnerable ConnectWise ScreenConnect server. The attacker can leverage
this to achieve RCE by uploading a malicious extension module. All versions of ScreenConnect version 23.9.7
and below are affected.

NEW
Explore Exposure Command
Confidently identify and prioritize exposures from endpoint to cloud with full attack surface visibility and threat-aware risk context.