ConnectWise ScreenConnect CVE-2024-1708

Exploitation requires network access to the ScreenConnect management web interface (typically TCP/8040 or 443 on internet-exposed instances) and, per CVSS PR:H, an authenticated administrative session on ScreenConnect; UI:R indicates a user-initiated action such as installing or modifying an extension is part of the exploit path. The realistic limiting factor is therefore admin access - however, in active in-the-wild attacks this prerequisite has been bypassed by chaining with CVE-2024-1709, which allows trivial creation of a new administrator. Self-hosted ScreenConnect 23.9.7 and earlier exposed to untrusted networks are the at-risk deployment; cloud-hosted screenconnect.com tenants were remediated by the vendor.

All real-world risk signals align toward critical priority: the vulnerability is confirmed actively exploited (CISA KEV), publicly available exploit code exists, and EPSS reports 53.66% probability at the 98th percentile - exceptionally high. The CVSS 3.1 score of 8.4 with vector AV:N/AC:L/PR:H/UI:R/S:C/C:H/I:H/A:H indicates a network-reachable, low-complexity attack, though it nominally requires high privileges and user interaction. This is the critical caveat: PR:H suggests prerequisites such as administrative access, yet in real-world incidents this CVE was chained with CVE-2024-1709 (authentication bypass) to obtain admin access trivially, neutralizing the PR:H limitation. The Scope:Changed and triple-High CIA impacts reflect full server takeover. Defenders should treat this as a top-tier emergency patch regardless of the PR:H qualifier, because the prerequisite has been broken in the wild.

An attacker reaches the internet-exposed ScreenConnect management interface, uses the companion CVE-2024-1709 authentication bypass to create a new administrator account, then leverages this path traversal to write a malicious .aspx or .ashx extension file into the ScreenConnect web root. Requesting that file executes attacker code as the ScreenConnect service account, providing a foothold from which to pivot into every endpoint already managed by that ScreenConnect server - a particularly devastating outcome in MSP environments. Public exploit code for this chain has been widely circulated since February 2024.