CVE-2023-25718: Critical severity connectwise vulnerability
DISPUTED In ConnectWise Control through 22.9.10032 (formerly known as ScreenConnect), after an executable file is signed, additional instructions can be added without invalidating the signature, such as instructions that result in offering the end user a (different) attacker-controlled executable file. It is plausible that the end user may allow the download and execution of this file to proceed. There are ConnectWise Control configuration options that add mitigations. NOTE: this may overlap CVE-2023-25719. NOTE: the vendor's position is that this purported vulnerability represents a "fundamental lack of understanding of Authenticode code signing behavior."
Affected Software
Event History
Frequently Asked Questions
What is CVE-2023-25718?
CVE-2023-25718 is a vulnerability in ConnectWise Control through version 22.9.10032 that allows the addition of instructions without invalidating the signature of an executable file.
How severe is CVE-2023-25718?
CVE-2023-25718 has a severity rating of 9.8, which is considered critical.
How does CVE-2023-25718 affect ConnectWise Control?
CVE-2023-25718 allows an attacker to add additional instructions to a signed executable file in ConnectWise Control, potentially leading to the execution of attacker-controlled code.
Is there a fix for CVE-2023-25718?
At the time of writing, there is no known fix or patch available for CVE-2023-25718. It is recommended to follow responsible security practices and stay alert for any updates from ConnectWise.
Where can I find more information about CVE-2023-25718?
You can find more information about CVE-2023-25718 on the ConnectWise website and in the provided references.