CVE-2024-1709

CVE-2024-1709 is a critical-severity (CVSS 10.0) vulnerability in ConnectWise ScreenConnect. CISA added it to the Known Exploited Vulnerabilities catalog on February 22, 2024, which means exploitation in the wild has been confirmed; US federal agencies had to remediate it by February 29, 2024. CISA also lists it as known to be used in ransomware campaigns, so it should be prioritised accordingly. ConnectWise has 4 vulnerabilities in the KEV catalog, 2 of them linked to ransomware.

ConnectWise ScreenConnect 23.9.7 and prior are affected by an Authentication Bypass Using an Alternate Path or Channel vulnerability, which may allow an attacker direct access to confidential information or critical systems.

CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H

• https://github.com/rapid7/metasploit-framework/pull/18870
• https://github.com/watchtowrlabs/connectwise-screenconnect_auth-bypass-add-user-poc
• https://techcrunch.com/2024/02/21/researchers-warn-high-risk-connectwise-flaw-under-attack-is-embarrassingly-easy-to-exploit/
• https://www.bleepingcomputer.com/news/security/connectwise-urges-screenconnect-admins-to-patch-critical-rce-flaw/
• https://www.connectwise.com/company/trust/security-bulletins/connectwise-screenconnect-23.9.8
• https://www.horizon3.ai/attack-research/red-team/connectwise-screenconnect-auth-bypass-deep-dive/
• https://www.huntress.com/blog/a-catastrophe-for-control-understanding-the-screenconnect-authentication-bypass
• https://www.huntress.com/blog/detection-guidance-for-connectwise-cwe-288-2