CVE-2023-25718

In ConnectWise Control through 22.9.10032 (formerly known as ScreenConnect), after an executable file is signed, additional instructions can be added without invalidating the signature, such as instructions that result in offering the end user a (different) attacker-controlled executable file. It is plausible that the end user may allow the download and execution of this file to proceed. There are ConnectWise Control configuration options that add mitigations.

• CWE-347

• https://cybir.com/2022/cve/connectwise-control-dns-spoofing-poc/Not Applicable
• https://m.youtube.com/watch?v=fbNVUgmstSc&pp=0gcJCf0Ao7VqN5tD
• https://www.connectwise.com/blog/cybersecurity/the-importance-of-responsible-security-disclosures
• https://cybir.com/2022/cve/connectwise-control-dns-spoofing-poc/Not Applicable
• https://www.connectwise.comProduct
• https://www.connectwise.com/blog/cybersecurity/the-importance-of-responsible-security-disclosures
• https://www.huntress.com/blog/clearing-the-air-overblown-claims-of-vulnerabilities-exploits-severity

Published

Feb 13, 2023

Last Modified

Jun 17, 2026

Status

Modified

• Same Subject, Wrong User: A Cross-Issuer Account Takeover in n8nStrix found an identity-binding bug in n8n's token-exchange flow enabling account takeover.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2023-25712Auth. (admin+) Stored Cross-Site Scripting (XSS) vulnerabili…4.8
• CVE-2023-25713Unauth. Stored Cross-Site Scripting (XSS) vulnerability in F…6.1
• CVE-2023-25714Missing Authorization vulnerability in Fullworks Quick Paypa…7.5
• CVE-2023-25715Missing Authorization vulnerability in GamiPress GamiPress –…6.5
• CVE-2023-25716Auth (admin+) Stored Cross-Site Scripting (XSS) vulnerabilit…4.8
• CVE-2023-25717Ruckus Wireless Admin through 10.4 allows Remote Code Execut…9.8
• CVE-2023-25719ConnectWise Control before 22.9.10032 (formerly known as Scr…8.8
• CVE-2023-2572The Survey Maker WordPress plugin before 3.4.7 does not esca…6.1
• CVE-2023-25721Veracode Scan Jenkins Plugin before 23.3.19.0, when the "Con…6.5
• CVE-2023-25722A credential-leak issue was discovered in related Veracode p…5.5
• CVE-2023-25723Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultID…
• CVE-2023-25724Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultID…