control vulnerabilities and fixes

Recent CVEs affecting control, with upgrade or downgrade steps. 11 tracked.

control has 11 tracked vulnerabilities, 3 critical. A fixed release or vendor patch exists for 6. Most recent: 2023-02-13. Highest priority: CVE-2019-16517 (score 62/100).

• CVE-2023-25719 HIGH 8.8 UPGRADE ConnectWise Control before 22.9.10032 (formerly known as ScreenConnect) fails to validate user-supplied parame
• CVE-2023-25718 CRITICAL 9.8 UPGRADE In ConnectWise Control through 22.9.10032 (formerly known as ScreenConnect), after an executable file is signe
• CVE-2021-36763 HIGH 7.5 UPGRADE UPGRADE In CODESYS V3 web server before 3.5.17.10, files or directories are accessible to External Parties.
• CVE-2021-33485 CRITICAL 9.8 UPGRADE UPGRADE CODESYS Control Runtime system before 3.5.17.10 has a Heap-based Buffer Overflow.
• CVE-2019-16517 CRITICAL 9.8 DOWNGRADE An issue was discovered in ConnectWise Control (formerly known as ScreenConnect) 19.3.25270.7185
• CVE-2019-16516 MEDIUM 5.3 UPGRADE An issue was discovered in ConnectWise Control (formerly known as ScreenConnect) 19.3.25270.7185
• CVE-2019-16515 MEDIUM 6.5 DOWNGRADE An issue was discovered in ConnectWise Control (formerly known as ScreenConnect) 19.3.25270.7185
• CVE-2019-16514 HIGH 7.2 DOWNGRADE An issue was discovered in ConnectWise Control (formerly known as ScreenConnect) 19.3.25270.7185
• CVE-2019-16513 HIGH 8.8 DOWNGRADE An issue was discovered in ConnectWise Control (formerly known as ScreenConnect) 19.3.25270.7185
• CVE-2019-16512 MEDIUM 4.8 DOWNGRADE An issue was discovered in ConnectWise Control (formerly known as ScreenConnect) 19.3.25270.7185
• CVE-2014-3857 MEDIUM 6.5 UPGRADE Multiple SQL injection vulnerabilities in Kerio Control Statistics in Kerio Control (formerly WinRoute Firewal

FAQ

How do I fix control vulnerabilities?

Open the CVE for your version, check the affected range, then follow the listed action: upgrade to the fixed release, or downgrade or mitigate if no fix exists yet. Commands for each OS are shown on every CVE page.

Is control being exploited right now?

None of the tracked control CVEs are on the CISA Known Exploited Vulnerabilities list at the moment. This is checked every 20 minutes.

Which control CVE should I patch first?

CVE-2019-16517 currently ranks highest (62/100): An issue was discovered in ConnectWise Control (formerly known as ScreenConnect) 19.3.25270.7185.

RSS feed for control · ← Back to latest CVEs