Horizon Alert
Summary of the vulnerability and why it matters
Certain versions of ScreenConnect software are susceptible to a code injection flaw. This weakness allows attackers to potentially execute arbitrary code on the server if they can first compromise privileged system keys. The impact could include unauthorized access and control over affected systems.
- Vulnerable ScreenConnect software versions.
- ViewState code injection.
- Remote code execution on servers.
Attack Path
How an attacker could exploit the issue
This vulnerability arises from a platform-level behavior rather than a specific flaw introduced by the software. Attackers must first compromise privileged system-level access to obtain sensitive machine keys. With these keys, an attacker can craft and deliver a malicious ViewState, potentially leading to remote code execution on the server.
- Exposure through privileged access.
- Attacker crafts malicious ViewState.
- Remote code execution on server.
Live Threat
Current exploitation, exposure, and threat context
This vulnerability could allow an attacker to execute code remotely on a server if they compromise specific machine keys. The risk originates from platform-level behavior rather than the application itself. A patch is available that disables the vulnerable feature.
- Attackers with high skill needed.
- Requires privileged access to machine keys.
- Elevated business risk; treat as urgent.
Priority actions
Operational Fix
Recommended remediation, mitigation, and detection steps
An organization's ScreenConnect instances may be vulnerable to code injection if machine keys are compromised. This could allow remote code execution on the server. The issue stems from platform-level behavior, not a direct ScreenConnect vulnerability, and does not impact the ScreenConnect Client. The vendor has released a patch that disables ViewState and removes dependencies on it.
- Identify ScreenConnect assets.
- Reduce exposure or isolate risk.
- Fix, verify, and monitor.
