CVE-2023-25719

ConnectWise Control before 22.9.10032 (formerly known as ScreenConnect) fails to validate user-supplied parameters such as the Bin/ConnectWiseControl.Client.exe h parameter. This results in reflected data and injection of malicious code into a downloaded executable. The executable can be used to execute malicious queries or as a denial-of-service vector. NOTE: this CVE Record is only about the parameters, such as the h parameter (this CVE Record is not about the separate issue of signed executable files that are supposed to have unique configurations across customers' installations).

• CWE-74
• CWE-74

• https://cybir.com/2022/cve/hijacking-connectwise-control-and-ddos/Exploit, Third Party Advisory
• https://m.youtube.com/watch?v=fbNVUgmstSc&pp=0gcJCf0Ao7VqN5tD
• https://www.connectwise.com/blog/cybersecurity/the-importance-of-responsible-security-disclosures
• https://cybir.com/2022/cve/hijacking-connectwise-control-and-ddos/Exploit, Third Party Advisory
• https://www.connectwise.comProduct
• https://www.connectwise.com/blog/cybersecurity/the-importance-of-responsible-security-disclosures
• https://www.huntress.com/blog/clearing-the-air-overblown-claims-of-vulnerabilities-exploits-severity

Published

Feb 13, 2023

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2023-25713Unauth. Stored Cross-Site Scripting (XSS) vulnerability in F…6.1
• CVE-2023-25714Missing Authorization vulnerability in Fullworks Quick Paypa…7.5
• CVE-2023-25715Missing Authorization vulnerability in GamiPress GamiPress –…6.5
• CVE-2023-25716Auth (admin+) Stored Cross-Site Scripting (XSS) vulnerabilit…4.8
• CVE-2023-25717Ruckus Wireless Admin through 10.4 allows Remote Code Execut…9.8
• CVE-2023-25718In ConnectWise Control through 22.9.10032 (formerly known as…9.8
• CVE-2023-2572The Survey Maker WordPress plugin before 3.4.7 does not esca…6.1
• CVE-2023-25721Veracode Scan Jenkins Plugin before 23.3.19.0, when the "Con…6.5
• CVE-2023-25722A credential-leak issue was discovered in related Veracode p…5.5
• CVE-2023-25723Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultID…
• CVE-2023-25724Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultID…
• CVE-2023-25725HAProxy before 2.7.3 may allow a bypass of access control be…9.1