Research · Feb 21, 2024 · ZeroDay Catalog
Critical Authentication Bypass Vulnerability in ConnectWise ScreenConnect
A significant authentication bypass vulnerability has been identified in ConnectWise ScreenConnect, potentially exposing sensitive information and systems.
What changed
ConnectWise has disclosed a critical vulnerability in its ScreenConnect product, specifically versions 23.9.7 and earlier. This vulnerability allows for authentication bypass through an alternate path or channel, which could lead to unauthorized access to sensitive data and critical systems.
Who is affected
Organizations utilizing ConnectWise ScreenConnect versions 23.9.7 and prior are at risk. This vulnerability could have serious implications for any entity relying on this remote support software.
- ConnectWise ScreenConnect users
- IT service providers using ConnectWise products
- Organizations with remote access needs
- Businesses managing sensitive information remotely
What to do
It is crucial for affected users to take immediate action to mitigate risks associated with this vulnerability. Upgrading to the latest version of ConnectWise ScreenConnect is strongly recommended to ensure protection against potential exploitation.
- Upgrade to ConnectWise ScreenConnect version 23.9.8 or later.
- Review access controls and authentication mechanisms.
- Monitor systems for any unauthorized access attempts.
- Stay informed on security updates from ConnectWise.