CVE-2024-1709

ConnectWise ScreenConnect Authentication Bypass

10.0 CRITICALActively exploited (CISA KEV)Used in ransomwarePublic exploitEPSS 100.0%

Published21 Feb 2024
Added to CISA KEV22 Feb 2024
Remediation due29 Feb 2024

Description

ConnectWise ScreenConnect 23.9.7 and prior are affected by an Authentication Bypass Using an Alternate Path or Channel vulnerability, which may allow an attacker direct access to confidential information or critical systems.

CVSS 3.1 breakdown

Attack vectorNetwork

Attack complexityLow

Privileges requiredNone

User interactionNone

ScopeChanged

ConfidentialityHigh

IntegrityHigh

AvailabilityHigh

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H

Affected products

ConnectWise Screenconnect< 23.9.8

Remediation

Fixed in

ConnectWise Screenconnect≥ 23.9.8

Patch & vendor advisories

References

https://github.com/rapid7/metasploit-framework/pull/18870Issue TrackingPatchThird Party Advisory
https://github.com/watchtowrlabs/connectwise-screenconnect_auth-bypass-add-user-pocExploitThird Party Advisory
https://techcrunch.com/2024/02/21/researchers-warn-high-risk-connectwise-flaw-under-attack-is-embarrassingly-easy-to-exploit/Press/Media CoverageThird Party Advisory
https://www.bleepingcomputer.com/news/security/connectwise-urges-screenconnect-admins-to-patch-critical-rce-flaw/Press/Media CoverageThird Party Advisory
https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2024-1709US Government Resource
https://www.connectwise.com/company/trust/security-bulletins/connectwise-screenconnect-23.9.8Vendor Advisory
https://www.horizon3.ai/attack-research/red-team/connectwise-screenconnect-auth-bypass-deep-dive/Third Party Advisory
https://www.huntress.com/blog/a-catastrophe-for-control-understanding-the-screenconnect-authentication-bypassExploitThird Party Advisory
https://www.huntress.com/blog/detection-guidance-for-connectwise-cwe-288-2ExploitThird Party Advisory
https://www.huntress.com/blog/vulnerability-reproduced-immediately-patch-screenconnect-23-9-8Third Party Advisory

and 1 more references

Related CVEs

Recent high-severity vulnerabilities sharing a weakness type.

Frequently asked

Is CVE-2024-1709 being actively exploited?

Yes. CVE-2024-1709 is listed in the CISA Known Exploited Vulnerabilities (KEV) catalog, added 22 Feb 2024. It has been used in ransomware campaigns.

How severe is CVE-2024-1709?

CVE-2024-1709 has a CVSS 3.1 base score of 10.0, rated critical. EPSS estimates a 100.0% probability of exploitation.

Which products are affected by CVE-2024-1709?

Affected products include ConnectWise Screenconnect.

How do I fix CVE-2024-1709?

Upgrade affected software to a fixed version, for example ConnectWise Screenconnect 23.9.8 or later, then confirm no affected versions remain in your inventory.

How Secuno handles this

Secuno correlates vulnerabilities like CVE-2024-1709 against the real software inventory on every managed device, as each hourly inventory arrives. Rather than a static severity, each match is scored in context: exploit availability, EPSS, the asset's exposure, and business criticality decide where it lands in the queue. Because it is on the CISA KEV list, a risk for it never ranks below high, and the update that fixes it moves to the Emergency patch lane. If an affected version is present anywhere across your portfolio, it surfaces automatically with a prioritised remediation path.

See how prioritisation works Book a demo

Data from the NVD, CISA KEV catalog and FIRST EPSS. CVSS 3.1 base score shown where available.