Summary
Ein entfernter Angreifer kann mehrere Schwachstellen in ConnectWise ScreenConnect ausnutzen, um Informationen offenzulegen oder um Sicherheitsmaßnahmen zu umgehen.
Product
ConnectWise ScreenConnect ist eine Softwarelösung für Fernzugriff, Fernsupport und Fernwartung von Computern, Servern, virtuellen Maschinen und mobilen Geräten.
Vulnerabilities 2
-
Critical 10.0
Authentication bypass using an alternate path or channel
ConnectWise ScreenConnect 23.9.7 and prior are affected by an Authentication Bypass Using an Alternate Path or Channel vulnerability, which may allow an attacker direct access to confidential information or critical systems.
KEV Feb 22, 2024 -
High 8.4
Improper limitation of a pathname to a restricted directory (“path traversal”)
ConnectWise ScreenConnect 23.9.7 and prior are affected by path-traversal vulnerability, which may allow an attacker the ability to execute remote code or directly impact confidential data or critical systems.
KEV Apr 28, 2026
Revision history
-
#3
Aktive Ausnutzung gemeldet
-
#2
Neuerstellung
-
#1
Initiale Fassung
References
-
ConnectWise Security Bulletins vom 2024-02-21
https://www.connectwise.com/company/trust/security-bulletins/connectwise-screenconnect-23.9.8
-
GitHub Watchtowrlabs vom 2024-02-21
https://github.com/watchtowrlabs/connectwise-screenconnect_auth-bypass-add-user-poc
-
Huntress PoC
https://www.huntress.com/blog/a-catastrophe-for-control-understanding-the-screenconnect-authentication-bypass
-
CISA Known Exploited Vulnerabilities Catalog vom 2026-04-28
https://www.cisa.gov/known-exploited-vulnerabilities-catalog