CVE-2019-16514: Malicious File Upload
First published: Thu Jan 23 2020(Updated: )
An issue was discovered in ConnectWise Control (formerly known as ScreenConnect) 19.3.25270.7185. The server allows remote code execution. Administrative users could upload an unsigned extension ZIP file containing executable code that is subsequently executed by the server.
Credit: cve@mitre.org
| Affected Software | Affected Version | How to fix |
|---|---|---|
| ConnectWise Control | =19.3.25270.7185 |
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
- https://blog.huntresslabs.com/validating-the-bishop-fox-findings-in-connectwise-control-9155eec36a34
- https://know.bishopfox.com/advisories
- https://know.bishopfox.com/advisories/connectwise-control
- https://www.crn.com/news/managed-services/connectwise-control-msp-security-vulnerabilities-are-severe-bishop-fox
- https://www.crn.com/slide-shows/managed-services/connectwise-control-attack-chain-exploit-20-questions-for-security-researcher-bishop-fox
Frequently Asked Questions
What is CVE-2019-16514?
CVE-2019-16514 is a vulnerability discovered in ConnectWise Control 19.3.25270.7185 that allows remote code execution.
How severe is CVE-2019-16514?
CVE-2019-16514 has a severity rating of 7.2 (high).
How can I fix CVE-2019-16514?
To fix CVE-2019-16514, update ConnectWise Control to a version that is not affected by the vulnerability.
Are all versions of ConnectWise Control affected by CVE-2019-16514?
No, only version 19.3.25270.7185 of ConnectWise Control is affected by CVE-2019-16514.
Is there any additional information about CVE-2019-16514?
Yes, you can find more information about CVE-2019-16514 in the references provided.
- collector/nvd-index
- agent/references
- agent/severity
- agent/author
- agent/last-modified-date
- agent/softwarecombine
- agent/first-publish-date
- agent/description
- agent/event
- agent/tags
- agent/weakness
- agent/type
- collector/mitre-cve
- source/MITRE
- vendor/connectwise
- canonical/connectwise control
- version/connectwise control/19.3.25270.7185