Vulnerability · Published Sep 28, 2022 · Assigned by INCD

CVE-2022-36781ConnectWise - ScreenConnect Session Code Bypass

Medium 5.3

In plain English

A medium-severity security flaw in ScreenConnect from ConnectWise. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.6% (higher than 51% of all known vulnerabilities).

Severity (CVSS 3.1)5.3Medium

Exploit odds (30 days)0.6%top 49.5% of all CVEs

Exploited in the wildNo reportsnot in CISA KEV

Attack toolingNoneno public tooling known

Official description

ConnectWise ScreenConnect versions 22.6 and below contained a flaw allowing potential brute force attacks on custom access tokens due to inadequate rate-limiting controls in the default configuration. Attackers could exploit this vulnerability to gain unauthorized access by repeatedly attempting access code combinations. ConnectWise has addressed this issue in later versions by implementing rate-limiting controls as a preventive measure against brute force attacks.

Affected products (as reported)

Vendor	Product	Versions
ConnectWise	ScreenConnect	22.7 – before 22.6*

References

https://www.gov.il/en/Departments/faq/cve_advisories