Critical severity · published Jan 23, 2020
CVE-2019-16517
An issue was discovered in ConnectWise Control (formerly known as ScreenConnect) 19.3.25270.7185
9.8
CVSS
1.3%
EPSS
No
On KEV
Description
An issue was discovered in ConnectWise Control (formerly known as ScreenConnect) 19.3.25270.7185. There is a CORS misconfiguration, which reflected the Origin provided by incoming requests. This allowed JavaScript running on any domain to interact with the server APIs and perform administrative actions, without the victim's knowledge.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Attack vector
Network
Complexity
Low
Privileges
None
User interaction
None
Confidentiality
High
Integrity
High
Availability
High
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)1.3% · higher than 71% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
SC
ScreenConnect · ConnectWise
19.3.25270.7185 · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2019-16517
CVE.org
https://www.cve.org/CVERecord?id=CVE-2019-16517
Exploit
https://blog.huntresslabs.com/validating-the-bishop-fox-findings-in-connectwise-control-9155eec36a34
Third Party Advisory
https://know.bishopfox.com/advisories
Exploit
https://know.bishopfox.com/advisories/connectwise-control
Third Party Advisory
https://www.crn.com/news/managed-services/connectwise-control-msp-security-vulnerabilities-are-severe-bishop-fox
Third Party Advisory
https://www.crn.com/slide-shows/managed-services/connectwise-control-attack-chain-exploit-20-questions-for-security-researcher-bishop-fox
More from ScreenConnect
10.0
CVE-2024-1709
Authentication bypass using an alternate path or channel
9.9
CVE-2026-84869
ScreenConnect Client: Guest-to-Host File Execution via File-Transfer Actions
8.4
CVE-2024-1708
Improper limitation of a pathname to a restricted directory (“path traversal”)
7.2
CVE-2025-3935
ScreenConnect Exposure to ASP.NET ViewState Code Injection
9.8
CVE-2023-25718
In ConnectWise Control through 22.9.10032 (formerly known as ScreenConnect), after an executable file is signed, additional instructions can be added without invalidating the…