CVE-2023-23130: ConnectWise Automate

Medium severity, CVSS 5.9. EPSS: 0.3% chance of exploitation in the next 30 days.

Connectwise Automate 2022.11 is vulnerable to Cleartext authentication. Authentication is being done via HTTP (cleartext) with SSL disabled. OTE: the vendor's position is that, by design, this is controlled by a configuration option in which a customer can choose to use HTTP (rather than HTTPS) during troubleshooting.

Affected products

• ConnectWise Automate: version 2022.11 only

Published 2023-02-01. Last modified 2026-06-17.