PT-2020-9830 · Connectwise · Connectwise Control

Matt Hamilton · Published 2020-01-23 · Updated 2020-01-28 · CVE-2019-16514

Positive Technologies (AI Summary)

CVSS v3.1

7.2

High

Base vector

AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions ConnectWise Control versions 19.3.25270.7185

Description An issue in ConnectWise Control allows remote code execution. Administrative users could upload an unsigned extension ZIP file containing executable code that is subsequently executed by the server.

Recommendations For version 19.3.25270.7185, consider restricting access to the extension upload feature to prevent potential exploitation until a fix is available. As a temporary workaround, limit administrative user privileges to minimize the risk of uploading malicious ZIP files.

Exploit

Fix

Unrestricted File Upload

Weakness Enumeration

CWE-434

Related Identifiers

CVE-2019-16514

Affected Products

Connectwise Control

References · 7

• 🔥 https://know.bishopfox.com/advisories/connectwise-control · Exploit
• 🔥 https://blog.huntresslabs.com/validating-the-bishop-fox-findings-in-connectwise-control-9155eec36a34 · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2019-16514 · Security Note
• https://osv.dev/vulnerability/CVE-2019-16514 · Vendor Advisory
• https://know.bishopfox.com/advisories · Note
• https://crn.com/slide-shows/managed-services/connectwise-control-attack-chain-exploit-20-questions-for-security-researcher-bishop-fox · Note
• https://crn.com/news/managed-services/connectwise-control-msp-security-vulnerabilities-are-severe-bishop-fox · Note