CVSS 3.1
7.2 highCVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:HCVE-2019-16514
High (7.2) in connectwise control. EPSS 4.2% chance of exploitation in the next 30 days.
An issue was discovered in ConnectWise Control (formerly known as ScreenConnect) 19.3.25270.7185. The server allows remote code execution. Administrative users could upload an unsigned extension ZIP file containing executable code that is subsequently executed by the server.
Severity
- EPSS
- 4.2% chance of exploitation in the next 30 days; higher than 91% of CVEs (scores of 2026-10-31)
- CWE
- CWE-434
- Published
- Modified
- Record from
- the NVD, synced
Affected
- connectwise:control
References
- https://blog.huntresslabs.com/validating-the-bishop-fox-findings-in-connectwise-control-9155eec36a34
- https://know.bishopfox.com/advisories
- https://know.bishopfox.com/advisories/connectwise-control
- https://www.crn.com/news/managed-services/connectwise-control-msp-security-vulnerabilities-are-severe-bishop-fox
- https://www.crn.com/slide-shows/managed-services/connectwise-control-attack-chain-exploit-20-questions-for-security-researcher-bishop-fox