Blank Access Key Bypass in Third-Party RMM Plugin Enables Mass Malware Deployment
Written by AI from the linked story. Not reviewed by an editor. How this works
A flaw in the third-party RMM+ plugin for ScreenConnect allowed attackers to completely bypass multi-factor authentication simply by submitting a blank access key — a critical authentication logic failure that required no sophisticated exploitation. Because RMM tools operate with broad, trusted access across managed endpoints, a single compromised plugin cascaded malware across 288 machines in 48 separate organizations. This incident illustrates how third-party extensions and plugins inherit the trust and reach of the platforms they extend, making their security posture as important as the core product's. Organizations that rely on remote monitoring and management tools must treat every plugin or extension as a potential attack surface subject to the same vetting rigor as the primary software.
Tactical Insight
Immediate actions
- Audit all third-party plugins and extensions installed in your RMM environment and remove or disable any that are not strictly necessary.
- Verify that MFA enforcement cannot be bypassed by empty, null, or default credential values in any authentication flow.
- Apply ConnectWise's remediation steps immediately and confirm affected RMM+ versions 1.0.31 and 1.0.32 are disabled or updated.
Long-term improvements
- Establish a formal vetting and approval process for any third-party plugin before it is permitted in production RMM environments.
- Restrict RMM tool access to known, authorized IP ranges and enforce least-privilege principles on all managed endpoints.
- Require vendors of third-party extensions to provide timely security advisories and maintain a current software bill of materials (SBOM).
Detection measures
- Monitor RMM platforms for anomalous authentication events, including logins with blank or unexpected credential fields.
- Deploy endpoint detection to alert on unusual processes or lateral movement originating from RMM agent activity.
- Correlate RMM access logs across managed endpoints to detect simultaneous or bulk deployment actions indicative of compromise.