ConnectWise.ScreenConnect.SetupModule.Authentication.Bypass
Description
This indicates an attack attempt to exploit an Authentication Bypass Vulnerability in ConnectWise ScreenConnect.
The vulnerability is due to improper validation of a request URL. A remote attacker could exploit this vulnerability by sending a crafted request to the target server. Successful exploitation could result in privilege escalation.
Outbreak Alert
Threat actors including ransomware gangs are seen exploiting newly discovered critical flaws in remote monitoring and management software called ScreenConnect.
Affected Products
ConnectWise ScreenConnect prior to 23.9.8
Impact
System Compromise: Remote attackers can gain control of vulnerable systems.
Recommended Actions
Apply the most recent upgrade or patch from the vendor.
https://www.connectwise.com/company/trust/security-bulletins/connectwise-screenconnect-23.9.8
Telemetry
Coverage
IPS (Regular DB) | |
IPS (Extended DB) |