CVE-2024-1709criticalunder attackransomwareCWE-288

CVE-2024-1709: critical vulnerability in ConnectWise ScreenConnect

Authentication bypass using an alternate path or channel

Published · Updated

Follow this CVE+ Monitor ScreenConnect

E-mail alert when it lands in KEV, gets a public PoC or its score goes up.

100Vexday Risk Score

Patch now. It under exploitation confirmed by CISA, has a working public exploit and 2 threat group(s) use it.

ssvc Actcvss 10epss 100%
from disclosure to weaponsame day
Published on NVDFeb 21
1st PoCFeb 21
metasploitFeb 19
CISA KEV+1d
Who exploits it — 2

Groups known to exploit this vulnerability (MITRE ATT&CK attribution).

Ransomwaremedusa CISA
APT / StateMedusa Group MITRE ATT&CK
Action required by CISAfederal deadline: 2024-02-29

Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.

In short

ConnectWise ScreenConnect versions 23.9.7 and earlier have a flaw that lets attackers bypass login requirements by using an alternate way to access the system, potentially gaining direct access to sensitive data and critical systems without valid credentials.

Technical detail

An authentication bypass vulnerability in ConnectWise ScreenConnect ≤23.9.7 allows unauthenticated attackers to circumvent login mechanisms via alternate access paths or channels (CWE-288), potentially enabling unauthorized access to confidential information and critical system functionality without requiring valid authentication credentials.

Summary generated and translated by AI from the official description.

The full analysis of this CVE is available in Portuguese →

ConnectWise ScreenConnect 23.9.7 and prior are affected by an Authentication Bypass Using an Alternate Path or Channel vulnerability, which may allow an attacker direct access to confidential information or critical systems.
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H
Affected products
ConnectWise · ScreenConnect
⚠ Public resources, to assess the exposure of systems you control or are authorized to test. Test only with authorization.
Related CVEs — ConnectWise ScreenConnect

In the same product, most dangerous first.

CVE-2024-1708HIGHImproper limitation of a pathname to a restricted directory (“path traversal”)EPSS 95.4%KEVCVE-2025-3935HIGHScreenConnect Exposure to ASP.NET ViewState Code InjectionEPSS 3.6%KEVCVE-2026-84869CRITICALScreenConnect Client: Guest-to-Host File Execution via File-Transfer ActionsEPSS 0.9%KEVCVE-2022-36781MEDIUMConnectWise - ScreenConnect Session Code BypassEPSS 0.6%CVE-2026-3564CRITICALScreenConnect Instance Level Cryptographic Material ExposureEPSS 0.4%CVE-2025-14265CRITICALImproper server-side validation in ScreenConnect extension frameworkEPSS 0.4%