Executable File Vulnerability in ConnectWise Control by ConnectWise
CVE-2023-25718
9.8CRITICAL
What is CVE-2023-25718?
In recent versions of ConnectWise Control, specifically 22.9.10032, a vulnerability exists wherein after an executable file is signed, additional instructions can be appended to the file without invalidating the signature. This manipulation may result in end users being presented with a malicious executable file controlled by an attacker. Given that users might inadvertently allow the download and execution of this file, it poses a significant risk. While there are configuration options within ConnectWise Control that can mitigate these risks, users should remain vigilant and informed about the underlying behaviors of Authenticode code signing.