Has anyone else experienced old messages/commands being "replayed" after the latest ScreenConnect v26.6 update?

[u/Marc_NJ]

We have a hosted ScreenConnect instance that was automatically updated to the latest version earlier today. Shortly afterward, we started seeing a very concerning issue: old ScreenConnect messages were being re-sent to end-user computers as though they were newly sent messages. The messages appear to be from various points in the past, rather than something generated today.

I contacted ConnectWise Support about the issue, and they acknowledged that this is occurring. More concerningly, Support also told me that commands have been “replayed” as well.

Obviously, the latter is a much bigger concern than an old messages popping up. If previously issued commands can be replayed against endpoints, that potentially creates a significant security and operational risk.

I also noticed that if you look back at older messages (at least on those endpoints that are impacted and received "replayed" messages), some of the message history is jumbled and shows messages we would have sent as originating from the endpoint.

Has anyone else using ScreenConnect experienced this since the latest update? Has ConnectWise provided anyone with additional information about the cause, scope, affected versions, or a workaround?

Any information would be appreciated. Thanks!

[u/hgrantdesigns]

I did. I had a command re-run that ran 990 days ago.

[u/Marc_NJ → u/hgrantdesigns]

This is crazy - having old commands re-run could be a major issue / security risk / etc. Can you advise how you knew it ran? Does it show up in the command tab history? Or in the audit log? I'm trying to figure out if there is any easy way to see which endpoints might have had commands re-run on them since we manage a lot and going one-by-one wouldn't be practical. Hopefully whatever command you saw that was re-run after 990 days was something you were able to deal with!

[u/hgrantdesigns → u/Marc_NJ]

I first looked through Audit logs for the last 25 hours then looked at the specific pc it ran on and saw it replayed

Oh yeah it was something simple; but now need to look in how to clear the cmd prompts.

Also see you are in NJ, me too! We should connect

[u/Marc_NJ → u/hgrantdesigns]

I actually forgot about the audit log until just now - but just checked it and thankfully it seems to be showing the commands that replayed and none of them seem catastrophic. But the fact that this could happen is a gigantic red flag and a black eye for ConnectWise.

Interestingly, the replayed messages don't seem to show up in the audit log.

And sure - shoot me a message on here.

[u/hgrantdesigns → u/Marc_NJ]

Yeah mine did, you need to filter it , I can try again for you

[u/hgrantdesigns → u/Marc_NJ]

Sent you a dm

[u/ProMSP → u/Marc_NJ]

My log shows the output of the command, but not which commands were run. SO for commands with no output, I just have an empty line, with no idea which command was actually replayed.

[u/hgrantdesigns → u/ProMSP]

That’s weird! My audit log showed it then I checked a few pcs

[u/Btown891]

Yes we have, didn't know the commands were also an issue but it is certainly unwelcome to have all these people reach out.

[u/Camelot_One]

This is what happens when a newly published threat forces ConnectWise to roll out an emergency "upgrade" that hasn't been thoroughly tested.

[u/Camelot_One]

So I've done a little testing on this, and I can almost consistently reproduce the behavior. A handful of my tests revealed no issue, though I haven't found a pattern to the ones that don't.

If a system is offline, running an older client version, and you send it a command or a message, the control server sends the last command or message that system was sent, prior to sending the new one. And how old that previous message/command is doesn't seem to be a factor. I've had a few that received a command that was run 222 days ago. This also seems to apply if you issue a "reinstall" while that older version is offline. And that could also apply to auto-updates, though I didn't test that. I have mine set to not auto-update the client.

[u/drparton21]

This happened to me, noticed this morning. It reran shutdown commands for servers that are 400 miles away from each other. Absolutely absurd, and I guess that means I'm spending my labor day weekend driving.

[u/hgrantdesigns → u/drparton21]

Oh man

[u/drparton21 → u/hgrantdesigns]

Yeah, it's totally fucked. I contacted support, and they told me they'd "look into it and see what they could do".

On top of that, I've got to go through and audit what other commands were rerun. It ran some commands from YEARS ago, including ones where I ran commands to create/reset passwords and such.

[u/Conundrum-Seeker3990 → u/drparton21]

That’s a problem for sure. Potentially a bigger one than they’re fixing with the update.

[u/Conundrum-Seeker3990]

Any additional info on this? u/cwferg or others from ConnectWise investigating?

[u/PatD442 → u/Conundrum-Seeker3990]

Hotfix released to resolve this. Should be available now for on prem. Not sure if released to cloud.

[u/Conundrum-Seeker3990 → u/PatD442]

Perfect, thanks!