CVE-2024-1709
ConnectWise ScreenConnect
Published 21 Feb 2024 · updated 17 Jun 2026 · Analyzed
10.0 Critical · CVSS 3.1, NVD
Exploited in the wild
CISA added this to its Known Exploited Vulnerabilities catalog on 22 Feb 2024, with a remediation deadline of 29 Feb 2024 for US federal agencies. It has been used in ransomware campaigns.
Required action: Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.
Description
ConnectWise ScreenConnect 23.9.7 and prior are affected by an Authentication Bypass Using an Alternate Path or Channel vulnerability, which may allow an attacker direct access to confidential information or critical systems.
References
- github.com/rapid7/metasploit-framework/pull/18870 · Issue Tracking, Patch, Third Party Advisory
- github.com/watchtowrlabs/connectwise-screenconnect_auth-bypass-add-user-poc · Exploit, Third Party Advisory
- techcrunch.com/2024/02/21/researchers-warn-high-risk-connectwise-flaw-under-attack-is-embarrassingly-easy-to-exploit/ · Press/Media Coverage, Third Party Advisory
- www.bleepingcomputer.com/news/security/connectwise-urges-screenconnect-admins-to-patch-critical-rce-flaw/ · Press/Media Coverage, Third Party Advisory
- www.connectwise.com/company/trust/security-bulletins/connectwise-screenconnect-23.9.8 · Vendor Advisory
- www.horizon3.ai/attack-research/red-team/connectwise-screenconnect-auth-bypass-deep-dive/ · Third Party Advisory
- www.huntress.com/blog/a-catastrophe-for-control-understanding-the-screenconnect-authentication-bypass · Exploit, Third Party Advisory
- www.huntress.com/blog/detection-guidance-for-connectwise-cwe-288-2 · Exploit, Third Party Advisory
- www.huntress.com/blog/vulnerability-reproduced-immediately-patch-screenconnect-23-9-8 · Third Party Advisory
- www.securityweek.com/connectwise-confirms-screenconnect-flaw-under-active-exploitation/ · Press/Media Coverage, Third Party Advisory
- www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2024-1709 · US Government Resource