High severity · published Jan 23, 2020
CVE-2019-16514
An issue was discovered in ConnectWise Control (formerly known as ScreenConnect) 19.3.25270.7185
7.2
CVSS
4.2%
EPSS
No
On KEV
Description
An issue was discovered in ConnectWise Control (formerly known as ScreenConnect) 19.3.25270.7185. The server allows remote code execution. Administrative users could upload an unsigned extension ZIP file containing executable code that is subsequently executed by the server.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H
Attack vector
Network
Complexity
Low
Privileges
High
User interaction
None
Confidentiality
High
Integrity
High
Availability
High
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)4.2% · higher than 91% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
SC
ScreenConnect · ConnectWise
19.3.25270.7185 · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2019-16514
CVE.org
https://www.cve.org/CVERecord?id=CVE-2019-16514
Exploit
https://blog.huntresslabs.com/validating-the-bishop-fox-findings-in-connectwise-control-9155eec36a34
Third Party Advisory
https://know.bishopfox.com/advisories
Exploit
https://know.bishopfox.com/advisories/connectwise-control
Third Party Advisory
https://www.crn.com/news/managed-services/connectwise-control-msp-security-vulnerabilities-are-severe-bishop-fox
Third Party Advisory
https://www.crn.com/slide-shows/managed-services/connectwise-control-attack-chain-exploit-20-questions-for-security-researcher-bishop-fox
More from ScreenConnect
10.0
CVE-2024-1709
Authentication bypass using an alternate path or channel
9.9
CVE-2026-84869
ScreenConnect Client: Guest-to-Host File Execution via File-Transfer Actions
8.4
CVE-2024-1708
Improper limitation of a pathname to a restricted directory (“path traversal”)
7.2
CVE-2025-3935
ScreenConnect Exposure to ASP.NET ViewState Code Injection
9.8
CVE-2023-25718
In ConnectWise Control through 22.9.10032 (formerly known as ScreenConnect), after an executable file is signed, additional instructions can be added without invalidating the…