Are remote support tools like ScreenConnect or SimpleHelp a risk?

What is a remote support tool?

ConnectWise ScreenConnect Authentication Bypass Vulnerability 2024-02-22 ConnectWise ScreenConnect contains an authentication bypass vulnerability that allows an attacker with network access to the management interface to create a new, administrator-level account on affected devices.

Tools such as ConnectWise ScreenConnect and SimpleHelp let a support person take control of your computers from elsewhere. The server part sits on the internet so it can reach each machine.

Why does it matter?

This incident reflects a broader pattern of ransomware actors targeting organizations through unpatched versions of SimpleHelp RMM since January 2025.

CISA added a ScreenConnect flaw to its catalog of exploited flaws on 22 February 2024. CISA says it let an attacker with network access to the management page create a new administrator account.

What if someone else runs the tool for us?

Isolate the SimpleHelp server instance from the internet or stop the server process.

The risk is the same. CISA's advisory covers SimpleHelp run by a provider on a customer's network, and tells the provider to isolate the server from the internet or stop it if it runs an affected version.

What do I do about it?

1. List every remote support tool installed on your computers and remove the ones nobody uses.
2. Check which version the server runs and update it to the current one.
3. Turn on multi-factor sign-in for every account on the tool.
4. Keep the server's admin page off the open internet where the tool allows it.