CVE-2024-1708: high-severity vulnerability in ConnectWise ScreenConnect
Improper limitation of a pathname to a restricted directory (“path traversal”)
Published · Updated
E-mail alert when it lands in KEV, gets a public PoC or its score goes up.
Patch now. It under exploitation confirmed by CISA and has a working public exploit.
Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.
ConnectWise ScreenConnect versions 23.9.7 and earlier contain a path-traversal flaw that lets attackers access files outside intended directories, potentially leading to remote code execution or exposure of sensitive data.
A path-traversal vulnerability in ConnectWise ScreenConnect ≤23.9.7 allows an unauthenticated or low-privileged attacker to escape directory restrictions and read or write arbitrary files on the system. Exploitation could lead to remote code execution or unauthorized access to confidential data and critical system resources.
The full analysis of this CVE is available in Portuguese →
In the same product, most dangerous first.