ScreenConnectのRMM+拡張に脆弱性、修正版なし
Summary
ConnectWise ScreenConnectの拡張機能RMM+に、初期値のAPIシークレットのままだと外部から管理端末へコマンドを送られかねない脆弱性が公表されました。オンプレミス環境でRMM+を使う組織は、すぐ無効化して状態を確認してください。
AI summary
Produced by SecPulse using an external AI model; it may contain mistakes. Check the original description and references below before acting on it.
ConnectWise ScreenConnectの拡張機能RMM+に、初期値のAPIシークレットのままだと外部から管理端末へコマンドを送られかねない脆弱性が公表されました。オンプレミス環境でRMM+を使う組織は、すぐ無効化して状態を確認してください。
Original description The description as published by the source.
The
third-party RMM+ extension for ConnectWise ScreenConnect uses a static API
secret by default. The value can be changed by an administrator; however,
environments retaining the default value may allow unauthorized access to
extension API functionality, including the ability to send commands to managed
agents. This issue is specific to the third-party extension and does not affect
the ScreenConnect server or client.
Scope: This issue affects the third-party RMM+
extension for ConnectWise ScreenConnect. Deployments without the extension are
not affected. ScreenConnect server or client software are not impacted.
Source: CVE.org (CVE Program・cvelistV5) NVD GitHub Advisory
References
- web github.com
- web nvd.nist.gov
- web github.com