Critical severity · published Feb 13, 2023
CVE-2023-25718
In ConnectWise Control through 22.9.10032 (formerly known as ScreenConnect), after an executable file is signed, additional instructions can be added without invalidating the…
9.8
CVSS
0.7%
EPSS
No
On KEV
Description
In ConnectWise Control through 22.9.10032 (formerly known as ScreenConnect), after an executable file is signed, additional instructions can be added without invalidating the signature, such as instructions that result in offering the end user a (different) attacker-controlled executable file. It is plausible that the end user may allow the download and execution of this file to proceed. There are ConnectWise Control configuration options that add mitigations.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Attack vector
Network
Complexity
Low
Privileges
None
User interaction
None
Confidentiality
High
Integrity
High
Availability
High
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)0.7% · higher than 52% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
SC
ScreenConnect · ConnectWise
through 22.9.10032 · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2023-25718
CVE.org
https://www.cve.org/CVERecord?id=CVE-2023-25718
Not Applicable
https://cybir.com/2022/cve/connectwise-control-dns-spoofing-poc/
m.youtube.com
https://m.youtube.com/watch?v=fbNVUgmstSc&pp=0gcJCf0Ao7VqN5tD
www.connectwise.com
https://www.connectwise.com/blog/cybersecurity/the-importance-of-responsible-security-disclosures
Product
https://www.connectwise.com
www.huntress.com
https://www.huntress.com/blog/clearing-the-air-overblown-claims-of-vulnerabilities-exploits-severity
More from ScreenConnect
10.0
CVE-2024-1709
Authentication bypass using an alternate path or channel
9.9
CVE-2026-84869
ScreenConnect Client: Guest-to-Host File Execution via File-Transfer Actions
8.4
CVE-2024-1708
Improper limitation of a pathname to a restricted directory (“path traversal”)
7.2
CVE-2025-3935
ScreenConnect Exposure to ASP.NET ViewState Code Injection
9.8
CVE-2019-16517
An issue was discovered in ConnectWise Control (formerly known as ScreenConnect) 19.3.25270.7185