Logo
-

Byte Open Security

(ByteOS Network)

Log In

Sign Up

ByteOS

Security
Vulnerability Details
Registries
Custom Views
Weaknesses
Attack Patterns
Filters & Tools
NVD Vulnerability Details :
CVE-2023-25718
Modified
More InfoOfficial Page
Source-cve@mitre.org
View Known Exploited Vulnerability (KEV) details
Published At-13 Feb, 2023 | 20:15
Updated At-19 Jun, 2025 | 21:15

In ConnectWise Control through 22.9.10032 (formerly known as ScreenConnect), after an executable file is signed, additional instructions can be added without invalidating the signature, such as instructions that result in offering the end user a (different) attacker-controlled executable file. It is plausible that the end user may allow the download and execution of this file to proceed. There are ConnectWise Control configuration options that add mitigations.

CISA Catalog
Date AddedDue DateVulnerability NameRequired Action
N/A
Date Added: N/A
Due Date: N/A
Vulnerability Name: N/A
Required Action: N/A
Metrics
TypeVersionBase scoreBase severityVector
Primary3.19.8CRITICAL
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Type: Primary
Version: 3.1
Base score: 9.8
Base severity: CRITICAL
Vector:
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
CPE Matches
connectwise
connectwise
>>control>>Versions up to 22.9.10032(inclusive)
cpe:2.3:a:connectwise:control:*:*:*:*:*:*:*:*
Weaknesses
CWE IDTypeSource
CWE-347Primarynvd@nist.gov
CWE ID: CWE-347
Type: Primary
Source: nvd@nist.gov
Evaluator Description
Evaluator Impact

Evaluator Solution

Vendor Statements
References
HyperlinkSourceResource
https://cybir.com/2022/cve/connectwise-control-dns-spoofing-poc/cve@mitre.org
Not Applicable
https://m.youtube.com/watch?v=fbNVUgmstSc&pp=0gcJCf0Ao7VqN5tDcve@mitre.org
N/A
https://www.connectwise.com/blog/cybersecurity/the-importance-of-responsible-security-disclosurescve@mitre.org
N/A
https://cybir.com/2022/cve/connectwise-control-dns-spoofing-poc/af854a3a-2127-422b-91ae-364da2661108
Not Applicable
https://www.connectwise.comaf854a3a-2127-422b-91ae-364da2661108
Product
https://www.connectwise.com/blog/cybersecurity/the-importance-of-responsible-security-disclosuresaf854a3a-2127-422b-91ae-364da2661108
N/A
https://www.huntress.com/blog/clearing-the-air-overblown-claims-of-vulnerabilities-exploits-severityaf854a3a-2127-422b-91ae-364da2661108
N/A
Hyperlink: https://cybir.com/2022/cve/connectwise-control-dns-spoofing-poc/
Source: cve@mitre.org
Resource:
Not Applicable
Hyperlink: https://m.youtube.com/watch?v=fbNVUgmstSc&pp=0gcJCf0Ao7VqN5tD
Source: cve@mitre.org
Resource: N/A
Hyperlink: https://www.connectwise.com/blog/cybersecurity/the-importance-of-responsible-security-disclosures
Source: cve@mitre.org
Resource: N/A
Hyperlink: https://cybir.com/2022/cve/connectwise-control-dns-spoofing-poc/
Source: af854a3a-2127-422b-91ae-364da2661108
Resource:
Not Applicable
Hyperlink: https://www.connectwise.com
Source: af854a3a-2127-422b-91ae-364da2661108
Resource:
Product
Hyperlink: https://www.connectwise.com/blog/cybersecurity/the-importance-of-responsible-security-disclosures
Source: af854a3a-2127-422b-91ae-364da2661108
Resource: N/A
Hyperlink: https://www.huntress.com/blog/clearing-the-air-overblown-claims-of-vulnerabilities-exploits-severity
Source: af854a3a-2127-422b-91ae-364da2661108
Resource: N/A
Change History
0Changes found
Details not found