{"api_version":"1","generated_at":"2026-04-23T01:11:51+00:00","cve":"CVE-2019-16514","urls":{"html":"https://cve.report/CVE-2019-16514","api":"https://cve.report/api/cve/CVE-2019-16514.json","docs":"https://cve.report/api","cve_org":"https://www.cve.org/CVERecord?id=CVE-2019-16514","nvd":"https://nvd.nist.gov/vuln/detail/CVE-2019-16514"},"summary":{"title":"CVE-2019-16514","description":"An issue was discovered in ConnectWise Control (formerly known as ScreenConnect) 19.3.25270.7185. The server allows remote code execution. Administrative users could upload an unsigned extension ZIP file containing executable code that is subsequently executed by the server.","state":"PUBLIC","assigner":"cve@mitre.org","published_at":"2020-01-23 18:15:00","updated_at":"2020-01-28 14:42:00"},"problem_types":["CWE-434"],"metrics":[],"references":[{"url":"https://www.crn.com/news/managed-services/connectwise-control-msp-security-vulnerabilities-are-severe-bishop-fox","name":"https://www.crn.com/news/managed-services/connectwise-control-msp-security-vulnerabilities-are-severe-bishop-fox","refsource":"MISC","tags":["Third Party Advisory"],"title":"ConnectWise Control MSP Security Vulnerabilities Are ‘Severe:’ Bishop Fox","mime":"text/html","httpstatus":"200","archivestatus":"200"},{"url":"https://know.bishopfox.com/advisories/connectwise-control","name":"https://know.bishopfox.com/advisories/connectwise-control","refsource":"MISC","tags":["Exploit","Third Party Advisory"],"title":"ConnectWise Control 19.3.25270.7185 - Eight Vulnerabilities, Including Critical","mime":"text/html","httpstatus":"200","archivestatus":"200"},{"url":"https://know.bishopfox.com/advisories","name":"https://know.bishopfox.com/advisories","refsource":"MISC","tags":["Third Party Advisory"],"title":"Bishop Fox Advisories","mime":"text/html","httpstatus":"200","archivestatus":"200"},{"url":"https://blog.huntresslabs.com/validating-the-bishop-fox-findings-in-connectwise-control-9155eec36a34","name":"https://blog.huntresslabs.com/validating-the-bishop-fox-findings-in-connectwise-control-9155eec36a34","refsource":"MISC","tags":["Exploit","Third Party Advisory"],"title":"Validating the Bishop Fox Findings in ConnectWise Control","mime":"text/html","httpstatus":"200","archivestatus":"200"},{"url":"https://www.crn.com/slide-shows/managed-services/connectwise-control-attack-chain-exploit-20-questions-for-security-researcher-bishop-fox","name":"https://www.crn.com/slide-shows/managed-services/connectwise-control-attack-chain-exploit-20-questions-for-security-researcher-bishop-fox","refsource":"MISC","tags":["Third Party Advisory"],"title":"ConnectWise Control 'Attack Chain' Exploit: 20 Questions For Security Researcher Bishop Fox","mime":"text/html","httpstatus":"200","archivestatus":"200"},{"url":"https://www.cve.org/CVERecord?id=CVE-2019-16514","name":"CVE Program record","refsource":"CVE.ORG","tags":["canonical"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2019-16514","name":"NVD vulnerability detail","refsource":"NVD","tags":["canonical","analysis"]}],"affected":[],"timeline":[],"solutions":[],"workarounds":[],"exploits":[],"credits":[],"nvd_cpes":[{"cve_year":"2019","cve_id":"16514","vulnerable":"1","versionEndIncluding":"","cpe1":"cpe","cpe2":"2.3","cpe3":"a","cpe4":"connectwise","cpe5":"control","cpe6":"19.3.25270.7185","cpe7":"*","cpe8":"*","cpe9":"*","cpe10":"*","cpe11":"*","cpe12":"*","cpe13":"*"},{"cve_year":"2019","cve_id":"16514","vulnerable":"1","versionEndIncluding":"1","cpe1":"cpe","cpe2":"2.3","cpe3":"a","cpe4":"connectwise","cpe5":"control","cpe6":"19.3.25270.7185","cpe7":"*","cpe8":"*","cpe9":"*","cpe10":"*","cpe11":"*","cpe12":"*","cpe13":"*"}],"vendor_comments":[],"enrichments":{"kev":null,"epss":null,"legacy_qids":[]},"source_records":{"cve_program":{"CVE_data_meta":{"ASSIGNER":"cve@mitre.org","ID":"CVE-2019-16514","STATE":"PUBLIC"},"affects":{"vendor":{"vendor_data":[{"product":{"product_data":[{"product_name":"n/a","version":{"version_data":[{"version_value":"n/a"}]}}]},"vendor_name":"n/a"}]}},"data_format":"MITRE","data_type":"CVE","data_version":"4.0","description":{"description_data":[{"lang":"eng","value":"An issue was discovered in ConnectWise Control (formerly known as ScreenConnect) 19.3.25270.7185. The server allows remote code execution. Administrative users could upload an unsigned extension ZIP file containing executable code that is subsequently executed by the server."}]},"problemtype":{"problemtype_data":[{"description":[{"lang":"eng","value":"n/a"}]}]},"references":{"reference_data":[{"url":"https://know.bishopfox.com/advisories","refsource":"MISC","name":"https://know.bishopfox.com/advisories"},{"refsource":"MISC","name":"https://know.bishopfox.com/advisories/connectwise-control","url":"https://know.bishopfox.com/advisories/connectwise-control"},{"refsource":"MISC","name":"https://blog.huntresslabs.com/validating-the-bishop-fox-findings-in-connectwise-control-9155eec36a34","url":"https://blog.huntresslabs.com/validating-the-bishop-fox-findings-in-connectwise-control-9155eec36a34"},{"refsource":"MISC","name":"https://www.crn.com/news/managed-services/connectwise-control-msp-security-vulnerabilities-are-severe-bishop-fox","url":"https://www.crn.com/news/managed-services/connectwise-control-msp-security-vulnerabilities-are-severe-bishop-fox"},{"refsource":"MISC","name":"https://www.crn.com/slide-shows/managed-services/connectwise-control-attack-chain-exploit-20-questions-for-security-researcher-bishop-fox","url":"https://www.crn.com/slide-shows/managed-services/connectwise-control-attack-chain-exploit-20-questions-for-security-researcher-bishop-fox"}]}},"nvd":{"publishedDate":"2020-01-23 18:15:00","lastModifiedDate":"2020-01-28 14:42:00","problem_types":["CWE-434"],"metrics":{"baseMetricV3":{"cvssV3":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"HIGH","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"HIGH","availabilityImpact":"HIGH","baseScore":7.2,"baseSeverity":"HIGH"},"exploitabilityScore":1.2,"impactScore":5.9},"baseMetricV2":{"cvssV2":{"version":"2.0","vectorString":"AV:N/AC:L/Au:S/C:P/I:P/A:P","accessVector":"NETWORK","accessComplexity":"LOW","authentication":"SINGLE","confidentialityImpact":"PARTIAL","integrityImpact":"PARTIAL","availabilityImpact":"PARTIAL","baseScore":6.5},"severity":"MEDIUM","exploitabilityScore":8,"impactScore":6.4,"acInsufInfo":false,"obtainAllPrivilege":false,"obtainUserPrivilege":false,"obtainOtherPrivilege":false,"userInteractionRequired":false}},"configurations":{"CVE_data_version":"4.0","nodes":[{"operator":"OR","children":[],"cpe_match":[{"vulnerable":true,"cpe23Uri":"cpe:2.3:a:connectwise:control:19.3.25270.7185:*:*:*:*:*:*:*","cpe_name":[]}]}]}},"legacy_mitre":{"record":{"CveYear":"2019","CveId":"16514","Ordinal":"156189","Title":"CVE-2019-16514","CVE":"CVE-2019-16514","Year":"2019"},"notes":[{"CveYear":"2019","CveId":"16514","Ordinal":"1","NoteData":"An issue was discovered in ConnectWise Control (formerly known as ScreenConnect) 19.3.25270.7185. The server allows remote code execution. Administrative users could upload an unsigned extension ZIP file containing executable code that is subsequently executed by the server.","Type":"Description","Title":null},{"CveYear":"2019","CveId":"16514","Ordinal":"2","NoteData":"2020-01-23","Type":"Other","Title":"Published"},{"CveYear":"2019","CveId":"16514","Ordinal":"3","NoteData":"2020-01-23","Type":"Other","Title":"Modified"}]}}}