ConnectWise ScreenConnect CVE-2024-1708
HIGHCVSS VectorNVD
CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:H/I:H/A:H
Lifecycle Timeline
1DescriptionNVD
ConnectWise ScreenConnect 23.9.7 and prior are affected by path-traversal vulnerability, which may allow an attacker
the ability to execute remote code or directly impact confidential data or critical systems.
AnalysisAI
Path traversal in ConnectWise ScreenConnect 23.9.7 and earlier enables attackers with administrative privileges to write files outside intended directories, leading to remote code execution or direct compromise of confidential data and critical systems. This vulnerability is confirmed actively exploited (CISA KEV) with publicly available exploit code, and the EPSS score of 53.66% (98th percentile) reflects extremely high real-world exploitation activity. It was disclosed alongside the more severe CVE-2024-1709 authentication bypass, which together formed a widely abused exploit chain against ScreenConnect on-premises servers in early 2024.
Technical ContextAI
ConnectWise ScreenConnect is a widely deployed remote support and remote access platform commonly used by managed service providers (MSPs) and IT teams to administer end-user systems. The root cause is CWE-22 (Improper Limitation of a Pathname to a Restricted Directory), where the application fails to properly sanitize user-supplied path components, allowing attackers to traverse the filesystem and write files into arbitrary locations such as the ScreenConnect web application directory. Because ScreenConnect serves .ashx and other executable handlers from its install directory, writing an attacker-controlled file into that path translates directly into code execution under the service account. The CPE cpe:2.3:a:connectwise:screenconnect:*:*:*:*:*:*:*:* covers all ScreenConnect product versions up to and including 23.9.7.
RemediationAI
Patch available per vendor advisory - upgrade self-hosted ScreenConnect to version 23.9.8 or later immediately, as ConnectWise released the fixed build to address both this path traversal and the companion authentication bypass CVE-2024-1709. Cloud-hosted (screenconnect.com) tenants were patched automatically by ConnectWise. If patching cannot be performed immediately, restrict network access to the ScreenConnect management web interface to a trusted management VLAN or VPN-only segment (this breaks remote technician access from arbitrary networks but stops external exploitation), and audit the App_Extensions directory and recent file writes for unexpected .aspx/.ashx artifacts indicative of post-exploitation webshells. After patching, rotate ScreenConnect admin credentials, review installed extensions, and hunt for indicators of compromise published by Huntress, Mandiant, and CISA, since active exploitation predates many organizations' patching windows.
Share
External POC / Exploit Code
Leaving vuln.today