CVE-2023-25719
- Reference to the description:
- Description:
- ConnectWise Control before 22.9.10032 (formerly known as ScreenConnect) fails to validate user-supplied parameters such as the Bin/ConnectWiseControl.Client.exe h parameter. This results in reflected data and injection of malicious code into a downloaded executable. The executable can be used to execute malicious queries or as a denial-of-service vector. NOTE: this CVE Record is only about the parameters, such as the h parameter (this CVE Record is not about the separate issue of signed executable files that are supposed to have unique configurations across customers' installations).
- Last updated date:
- 03/05/2023
- Type:
- exploit
- Confidence:
- HIGH
- Date of publishing:
- 02/23/2023
- Reference url to background
https://cybir.com/2022/cve/hijacking-connectwise-control-and-ddos/