CVE-2024-1709
CRITICALCVSS Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H
Lifecycle Timeline
5Description
ConnectWise ScreenConnect 23.9.7 and prior are affected by an Authentication Bypass Using an Alternate Path or Channel vulnerability, which may allow an attacker direct access to confidential information or critical systems.
Analysis
ConnectWise ScreenConnect contains a critical authentication bypass (CVSS 10.0) that allows direct access to the administrative interface, mass-exploited within hours of disclosure for ransomware deployment.
Technical Context
The CWE-288 authentication bypass allows attackers to access the initial setup wizard even after ScreenConnect has been configured. This provides the ability to create new administrator accounts, modify server configuration, and execute code on all connected endpoints.
Affected Products
['ConnectWise ScreenConnect 23.9.7 and prior']
Remediation
Update ScreenConnect immediately to 23.9.8+. ConnectWise cloud-hosted instances were auto-patched. On-premise instances require manual update. Audit for unauthorized admin accounts. Check all managed endpoints for compromise.
Priority Score
Share
External POC / Exploit Code
Leaving vuln.today