CVE-2022-36781 ConnectWise - ScreenConnect Session Code Bypass

Medium 5.3 Published 28 Sep 2022 Updated 16 Sep 2024

Attackers can brute force access tokens due to missing rate limiting, gaining unauthorized remote access to ScreenConnect sessions.

Exploited in the wild: Not known
Login needed: Not needed
Attackable: Over the internet
Victim action needed: Not needed
Fix: None listed

What is CVE-2022-36781?

CVE-2022-36781 is a medium-severity authentication bypass vulnerability in ConnectWise ScreenConnect, published on 28 Sep 2022. An attacker can exploit it over the internet without logging in, with no action from the victim.

Official description

ConnectWise ScreenConnect versions 22.6 and below contained a flaw allowing potential brute force attacks on custom access tokens due to inadequate rate-limiting controls in the default configuration. Attackers could exploit this vulnerability to gain unauthorized access by repeatedly attempting access code combinations. ConnectWise has addressed this issue in later versions by implementing rate-limiting controls as a preventive measure against brute force attacks.

Weakness: CWE-307

Which versions are affected by CVE-2022-36781?

It affects 1 product.

Products include Connectwise Screenconnect.

How do I fix CVE-2022-36781?

No fix has been published for CVE-2022-36781 yet. Limit exposure of the affected software until one is available.

Upgrade, and rotate credentials and sessions that may have been exposed. More about Authentication bypass.

Is CVE-2022-36781 being exploited?

There is no known exploitation of CVE-2022-36781 in the wild and no public exploit code.

Sources

Also known as GHSA-9xh6-8fcg-f9qm.