CVE-2023-25718 (GCVE-0-2023-25718)

Vulnerability from cvelistv5 – Published: 2023-02-13 00:00 – Updated: 2025-06-19 20:35
VLAI?
Summary
In ConnectWise Control through 22.9.10032 (formerly known as ScreenConnect), after an executable file is signed, additional instructions can be added without invalidating the signature, such as instructions that result in offering the end user a (different) attacker-controlled executable file. It is plausible that the end user may allow the download and execution of this file to proceed. There are ConnectWise Control configuration options that add mitigations.
Severity ?
No CVSS data available.
CWE
  • n/a
Assigner
References
Show details on NVD website
To clipboard 

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2023-25718",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "yes"
                  },
                  {
                    "Technical Impact": "total"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2024-04-22T15:04:00.656149Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2024-06-04T17:18:47.046Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      },
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-02T11:32:11.396Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://www.connectwise.com"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://cybir.com/2022/cve/connectwise-control-dns-spoofing-poc/"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://www.huntress.com/blog/clearing-the-air-overblown-claims-of-vulnerabilities-exploits-severity"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://www.connectwise.com/blog/cybersecurity/the-importance-of-responsible-security-disclosures"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "n/a",
          "vendor": "n/a",
          "versions": [
            {
              "status": "affected",
              "version": "n/a"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In ConnectWise Control through 22.9.10032 (formerly known as ScreenConnect), after an executable file is signed, additional instructions can be added without invalidating the signature, such as instructions that result in offering the end user a (different) attacker-controlled executable file. It is plausible that the end user may allow the download and execution of this file to proceed. There are ConnectWise Control configuration options that add mitigations."
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "description": "n/a",
              "lang": "en",
              "type": "text"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2025-06-19T20:35:05.481Z",
        "orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
        "shortName": "mitre"
      },
      "references": [
        {
          "url": "https://cybir.com/2022/cve/connectwise-control-dns-spoofing-poc/"
        },
        {
          "url": "https://www.connectwise.com/blog/cybersecurity/the-importance-of-responsible-security-disclosures"
        },
        {
          "url": "https://m.youtube.com/watch?v=fbNVUgmstSc\u0026pp=0gcJCf0Ao7VqN5tD"
        }
      ]
    }
  },
  "cveMetadata": {
    "assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
    "assignerShortName": "mitre",
    "cveId": "CVE-2023-25718",
    "datePublished": "2023-02-13T00:00:00.000Z",
    "dateReserved": "2023-02-13T00:00:00.000Z",
    "dateUpdated": "2025-06-19T20:35:05.481Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1",
  "vulnerability-lookup:meta": {
    "fkie_nvd": {
      "configurations": "[{\"nodes\": [{\"operator\": \"OR\", \"negate\": false, \"cpeMatch\": [{\"vulnerable\": true, \"criteria\": \"cpe:2.3:a:connectwise:control:*:*:*:*:*:*:*:*\", \"versionEndIncluding\": \"22.9.10032\", \"matchCriteriaId\": \"E662D8E7-CE49-4030-91E7-8D132A25F9C5\"}]}]}]",
      "cveTags": "[{\"sourceIdentifier\": \"cve@mitre.org\", \"tags\": [\"disputed\"]}]",
      "descriptions": "[{\"lang\": \"en\", \"value\": \"In ConnectWise Control through 22.9.10032 (formerly known as ScreenConnect), after an executable file is signed, additional instructions can be added without invalidating the signature, such as instructions that result in offering the end user a (different) attacker-controlled executable file. It is plausible that the end user may allow the download and execution of this file to proceed. There are ConnectWise Control configuration options that add mitigations. NOTE: this may overlap CVE-2023-25719. NOTE: the vendor\u0027s position is that this purported vulnerability represents a \\\"fundamental lack of understanding of Authenticode code signing behavior.\\\"\"}, {\"lang\": \"es\", \"value\": \"En ConnectWise Control hasta 22.9.10032 (anteriormente conocido como ScreenConnect), despu\\u00e9s de firmar un archivo ejecutable, se pueden agregar instrucciones adicionales sin invalidar la firma, como instrucciones que dan como resultado ofrecer al usuario final un archivo ejecutable (diferente) controlado por el atacante. Es posible que el usuario final permita que se realice la descarga y ejecuci\\u00f3n de este archivo. Hay opciones de configuraci\\u00f3n de ConnectWise Control que agregan mitigaciones. NOTA: esto puede superponerse a CVE-2023-25719. NOTA: la posici\\u00f3n del proveedor es que esta supuesta vulnerabilidad representa una \\\"falta fundamental de comprensi\\u00f3n del comportamiento de firma del c\\u00f3digo Authenticode\\\".\"}]",
      "id": "CVE-2023-25718",
      "lastModified": "2024-11-21T07:49:59.913",
      "metrics": "{\"cvssMetricV31\": [{\"source\": \"nvd@nist.gov\", \"type\": \"Primary\", \"cvssData\": {\"version\": \"3.1\", \"vectorString\": \"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H\", \"baseScore\": 9.8, \"baseSeverity\": \"CRITICAL\", \"attackVector\": \"NETWORK\", \"attackComplexity\": \"LOW\", \"privilegesRequired\": \"NONE\", \"userInteraction\": \"NONE\", \"scope\": \"UNCHANGED\", \"confidentialityImpact\": \"HIGH\", \"integrityImpact\": \"HIGH\", \"availabilityImpact\": \"HIGH\"}, \"exploitabilityScore\": 3.9, \"impactScore\": 5.9}]}",
      "published": "2023-02-13T20:15:11.040",
      "references": "[{\"url\": \"https://cybir.com/2022/cve/connectwise-control-dns-spoofing-poc/\", \"source\": \"cve@mitre.org\", \"tags\": [\"Not Applicable\"]}, {\"url\": \"https://www.connectwise.com\", \"source\": \"cve@mitre.org\", \"tags\": [\"Product\"]}, {\"url\": \"https://www.connectwise.com/blog/cybersecurity/the-importance-of-responsible-security-disclosures\", \"source\": \"cve@mitre.org\"}, {\"url\": \"https://www.huntress.com/blog/clearing-the-air-overblown-claims-of-vulnerabilities-exploits-severity\", \"source\": \"cve@mitre.org\"}, {\"url\": \"https://cybir.com/2022/cve/connectwise-control-dns-spoofing-poc/\", \"source\": \"af854a3a-2127-422b-91ae-364da2661108\", \"tags\": [\"Not Applicable\"]}, {\"url\": \"https://www.connectwise.com\", \"source\": \"af854a3a-2127-422b-91ae-364da2661108\", \"tags\": [\"Product\"]}, {\"url\": \"https://www.connectwise.com/blog/cybersecurity/the-importance-of-responsible-security-disclosures\", \"source\": \"af854a3a-2127-422b-91ae-364da2661108\"}, {\"url\": \"https://www.huntress.com/blog/clearing-the-air-overblown-claims-of-vulnerabilities-exploits-severity\", \"source\": \"af854a3a-2127-422b-91ae-364da2661108\"}]",
      "sourceIdentifier": "cve@mitre.org",
      "vulnStatus": "Modified",
      "weaknesses": "[{\"source\": \"nvd@nist.gov\", \"type\": \"Primary\", \"description\": [{\"lang\": \"en\", \"value\": \"CWE-347\"}]}]"
    },
    "nvd": "{\"cve\":{\"id\":\"CVE-2023-25718\",\"sourceIdentifier\":\"cve@mitre.org\",\"published\":\"2023-02-13T20:15:11.040\",\"lastModified\":\"2025-06-19T21:15:22.163\",\"vulnStatus\":\"Modified\",\"cveTags\":[],\"descriptions\":[{\"lang\":\"en\",\"value\":\"In ConnectWise Control through 22.9.10032 (formerly known as ScreenConnect), after an executable file is signed, additional instructions can be added without invalidating the signature, such as instructions that result in offering the end user a (different) attacker-controlled executable file. It is plausible that the end user may allow the download and execution of this file to proceed. There are ConnectWise Control configuration options that add mitigations.\"},{\"lang\":\"es\",\"value\":\"En ConnectWise Control hasta 22.9.10032 (anteriormente conocido como ScreenConnect), despu\u00e9s de firmar un archivo ejecutable, se pueden agregar instrucciones adicionales sin invalidar la firma, como instrucciones que dan como resultado ofrecer al usuario final un archivo ejecutable (diferente) controlado por el atacante. Es posible que el usuario final permita que se realice la descarga y ejecuci\u00f3n de este archivo. Hay opciones de configuraci\u00f3n de ConnectWise Control que agregan mitigaciones. NOTA: esto puede superponerse a CVE-2023-25719. NOTA: la posici\u00f3n del proveedor es que esta supuesta vulnerabilidad representa una \\\"falta fundamental de comprensi\u00f3n del comportamiento de firma del c\u00f3digo Authenticode\\\".\"}],\"metrics\":{\"cvssMetricV31\":[{\"source\":\"nvd@nist.gov\",\"type\":\"Primary\",\"cvssData\":{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H\",\"baseScore\":9.8,\"baseSeverity\":\"CRITICAL\",\"attackVector\":\"NETWORK\",\"attackComplexity\":\"LOW\",\"privilegesRequired\":\"NONE\",\"userInteraction\":\"NONE\",\"scope\":\"UNCHANGED\",\"confidentialityImpact\":\"HIGH\",\"integrityImpact\":\"HIGH\",\"availabilityImpact\":\"HIGH\"},\"exploitabilityScore\":3.9,\"impactScore\":5.9}]},\"weaknesses\":[{\"source\":\"nvd@nist.gov\",\"type\":\"Primary\",\"description\":[{\"lang\":\"en\",\"value\":\"CWE-347\"}]}],\"configurations\":[{\"nodes\":[{\"operator\":\"OR\",\"negate\":false,\"cpeMatch\":[{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:connectwise:control:*:*:*:*:*:*:*:*\",\"versionEndIncluding\":\"22.9.10032\",\"matchCriteriaId\":\"E662D8E7-CE49-4030-91E7-8D132A25F9C5\"}]}]}],\"references\":[{\"url\":\"https://cybir.com/2022/cve/connectwise-control-dns-spoofing-poc/\",\"source\":\"cve@mitre.org\",\"tags\":[\"Not Applicable\"]},{\"url\":\"https://m.youtube.com/watch?v=fbNVUgmstSc\u0026pp=0gcJCf0Ao7VqN5tD\",\"source\":\"cve@mitre.org\"},{\"url\":\"https://www.connectwise.com/blog/cybersecurity/the-importance-of-responsible-security-disclosures\",\"source\":\"cve@mitre.org\"},{\"url\":\"https://cybir.com/2022/cve/connectwise-control-dns-spoofing-poc/\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\",\"tags\":[\"Not Applicable\"]},{\"url\":\"https://www.connectwise.com\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\",\"tags\":[\"Product\"]},{\"url\":\"https://www.connectwise.com/blog/cybersecurity/the-importance-of-responsible-security-disclosures\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\"},{\"url\":\"https://www.huntress.com/blog/clearing-the-air-overblown-claims-of-vulnerabilities-exploits-severity\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\"}]}}",
    "vulnrichment": {
      "containers": "{\"adp\": [{\"title\": \"CVE Program Container\", \"references\": [{\"url\": \"https://www.connectwise.com\", \"tags\": [\"x_transferred\"]}, {\"url\": \"https://cybir.com/2022/cve/connectwise-control-dns-spoofing-poc/\", \"tags\": [\"x_transferred\"]}, {\"url\": \"https://www.huntress.com/blog/clearing-the-air-overblown-claims-of-vulnerabilities-exploits-severity\", \"tags\": [\"x_transferred\"]}, {\"url\": \"https://www.connectwise.com/blog/cybersecurity/the-importance-of-responsible-security-disclosures\", \"tags\": [\"x_transferred\"]}], \"providerMetadata\": {\"orgId\": \"af854a3a-2127-422b-91ae-364da2661108\", \"shortName\": \"CVE\", \"dateUpdated\": \"2024-08-02T11:32:11.396Z\"}}, {\"metrics\": [{\"other\": {\"type\": \"ssvc\", \"content\": {\"id\": \"CVE-2023-25718\", \"role\": \"CISA Coordinator\", \"options\": [{\"Exploitation\": \"none\"}, {\"Automatable\": \"yes\"}, {\"Technical Impact\": \"total\"}], \"version\": \"2.0.3\", \"timestamp\": \"2024-04-22T15:04:00.656149Z\"}}}], \"providerMetadata\": {\"orgId\": \"134c704f-9b21-4f2e-91b3-4a467353bcc0\", \"shortName\": \"CISA-ADP\", \"dateUpdated\": \"2024-04-24T22:23:36.875Z\"}, \"title\": \"CISA ADP Vulnrichment\"}], \"cna\": {\"affected\": [{\"vendor\": \"n/a\", \"product\": \"n/a\", \"versions\": [{\"status\": \"affected\", \"version\": \"n/a\"}]}], \"references\": [{\"url\": \"https://cybir.com/2022/cve/connectwise-control-dns-spoofing-poc/\"}, {\"url\": \"https://www.connectwise.com/blog/cybersecurity/the-importance-of-responsible-security-disclosures\"}, {\"url\": \"https://m.youtube.com/watch?v=fbNVUgmstSc\u0026pp=0gcJCf0Ao7VqN5tD\"}], \"descriptions\": [{\"lang\": \"en\", \"value\": \"In ConnectWise Control through 22.9.10032 (formerly known as ScreenConnect), after an executable file is signed, additional instructions can be added without invalidating the signature, such as instructions that result in offering the end user a (different) attacker-controlled executable file. It is plausible that the end user may allow the download and execution of this file to proceed. There are ConnectWise Control configuration options that add mitigations.\"}], \"problemTypes\": [{\"descriptions\": [{\"lang\": \"en\", \"type\": \"text\", \"description\": \"n/a\"}]}], \"providerMetadata\": {\"orgId\": \"8254265b-2729-46b6-b9e3-3dfca2d5bfca\", \"shortName\": \"mitre\", \"dateUpdated\": \"2025-06-19T20:35:05.481Z\"}}}",
      "cveMetadata": "{\"cveId\": \"CVE-2023-25718\", \"state\": \"PUBLISHED\", \"dateUpdated\": \"2025-06-19T20:35:05.481Z\", \"dateReserved\": \"2023-02-13T00:00:00.000Z\", \"assignerOrgId\": \"8254265b-2729-46b6-b9e3-3dfca2d5bfca\", \"datePublished\": \"2023-02-13T00:00:00.000Z\", \"assignerShortName\": \"mitre\"}",
      "dataType": "CVE_RECORD",
      "dataVersion": "5.1"
    }
  }
}


Log in or create an account to share your comment.




Tags
Taxonomy of the tags.




Sightings

Author Source Type Date

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.



Detection rules are retrieved from Rulezet.