CVE-2019-16514
Summary
| CVE | CVE-2019-16514 |
|---|---|
| State | PUBLIC |
| Assigner | [email protected] |
| Source Priority | CVE Program / NVD first with legacy fallback |
| Published | 2020-01-23 18:15:00 UTC |
| Updated | 2020-01-28 14:42:00 UTC |
| Description | An issue was discovered in ConnectWise Control (formerly known as ScreenConnect) 19.3.25270.7185. The server allows remote code execution. Administrative users could upload an unsigned extension ZIP file containing executable code that is subsequently executed by the server. |
Risk And Classification
Problem Types: CWE-434
NVD Known Affected Configurations (CPE 2.3)
| Type | Vendor | Product | Version | Update | Edition | Language |
|---|---|---|---|---|---|---|
| Application | Connectwise | Control | 19.3.25270.7185 | All | All | All |
| Application | Connectwise | Control | 19.3.25270.7185 | All | All | All |
References
| Reference | Source | Link | Tags |
|---|---|---|---|
| ConnectWise Control MSP Security Vulnerabilities Are ‘Severe:’ Bishop Fox | MISC | www.crn.com | Third Party Advisory |
| ConnectWise Control 19.3.25270.7185 - Eight Vulnerabilities, Including Critical | MISC | know.bishopfox.com | Exploit, Third Party Advisory |
| Bishop Fox Advisories | MISC | know.bishopfox.com | Third Party Advisory |
| Validating the Bishop Fox Findings in ConnectWise Control | MISC | blog.huntresslabs.com | Exploit, Third Party Advisory |
| ConnectWise Control 'Attack Chain' Exploit: 20 Questions For Security Researcher Bishop Fox | MISC | www.crn.com | Third Party Advisory |
| CVE Program record | CVE.ORG | www.cve.org | canonical |
| NVD vulnerability detail | NVD | nvd.nist.gov | canonical, analysis |
No vendor comments have been submitted for this CVE.
There are currently no legacy QID mappings associated with this CVE.