Multiple vulnerabilities, have been discovered in ConnectWise ScreenConnect, the most severe of which could allow for remote code execution. ConnectWise ScreenConnect is ConnectWise’s remote desktop and mobile support solutions that enable technicians to perform remote support, gain remote access, and run remote meetings. Successful exploitation of the most severe of these vulnerabilities could allow for remote code execution in the context of the system. Depending on the privileges associated with the service account, an attacker could then install programs; view, change, or delete data. Service accounts that are configured to have fewer user rights on the system could be less impacted than those who operate with administrative user rights.

Risk

1. Government:
   – Large and medium government entities: High
   – Small government entities: High
2. Businesses:
   – Large and medium business entities: High
   – Small business entities: High
3. Home Users: Low

Recommendations

• Apply appropriate updates provided by ConnectWise to vulnerable systems
  immediately after appropriate testing.
• Vulnerability scanning is used to find potentially exploitable software vulnerabilities to
  remediate them.
• Apply the Principle of Least Privilege to all systems and services. Run all software as a
  non-privileged user (one without administrative privileges) to diminish the effects of a
  successful attack.
• Architect sections of the network to isolate critical systems, functions, or resources. Use
  physical and logical segmentation to prevent access to potentially sensitive systems
  and information. Use a DMZ to contain any internet-facing services that should not be
  exposed from the internal network. Configure separate virtual private cloud (VPC)
  instances to isolate critical cloud systems.
• Use capabilities to detect and block conditions that may lead to or be indicative of a
  software exploit occurring.
• Restrict use of certain websites, block downloads/attachments, block JavaScript,
  restrict browser extensions, etc.
• Remind users not to visit untrusted websites or follow links provided by unknown or
  untrusted sources. Inform and educate users regarding the threats posed by hypertext
  links contained in emails or attachments, especially from untrusted sources.

Reporting

Report any malicious cyber activity to the NJCCIC via the cyber incident report form at www.cyber.nj.gov/report. If you have any questions don’t hesitate to contact us here at Cyber Command.