CVE-2024-1709
Authentication bypass using an alternate path or channel
In short
ConnectWise ScreenConnect versions 23.9.7 and earlier have a flaw that lets attackers bypass login requirements by using an alternate way to access the system, potentially gaining direct access to sensitive data and critical systems without valid credentials.
Technical detail
An authentication bypass vulnerability in ConnectWise ScreenConnect ≤23.9.7 allows unauthenticated attackers to circumvent login mechanisms via alternate access paths or channels (CWE-288), potentially enabling unauthorized access to confidential information and critical system functionality without requiring valid authentication credentials.
Summary generated and translated by AI from the official description.
ConnectWise ScreenConnect 23.9.7 and prior are affected by an Authentication Bypass Using an Alternate Path or Channel
vulnerability, which may allow an attacker direct access to confidential information or
critical systems.
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H
Affected products
ConnectWise · ScreenConnectpublic PoCs found — 5
githubgithub.com/W01fh4cker/ScreenConnect-AuthBypass-RCE★ 110githubgithub.com/HussainFathy/CVE-2024-1709★ 3githubgithub.com/sxyrxyy/CVE-2024-1709-ConnectWise-ScreenConnect-Authentication-Bypass★ 1githubgithub.com/cjybao/CVE-2024-1709-and-CVE-2024-1708★ 1githubgithub.com/AhmedMansour93/Event-ID-229-Rule-Name-SOC262-CVE-2024-1709-★ 0⚠ Public resources, to assess the exposure of systems you control or are authorized to test. Test only with authorization.
Want to know if your infrastructure is exposed to this?
Talk to TrueHacking →References
https://github.com/rapid7/metasploit-framework/pull/18870https://github.com/watchtowrlabs/connectwise-screenconnect_auth-bypass-add-user-pochttps://techcrunch.com/2024/02/21/researchers-warn-high-risk-connectwise-flaw-under-attack-is-embarrassingly-easy-to-exploit/https://www.bleepingcomputer.com/news/security/connectwise-urges-screenconnect-admins-to-patch-critical-rce-flaw/https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2024-1709https://www.connectwise.com/company/trust/security-bulletins/connectwise-screenconnect-23.9.8https://www.horizon3.ai/attack-research/red-team/connectwise-screenconnect-auth-bypass-deep-dive/https://www.huntress.com/blog/a-catastrophe-for-control-understanding-the-screenconnect-authentication-bypasshttps://www.huntress.com/blog/detection-guidance-for-connectwise-cwe-288-2https://www.huntress.com/blog/vulnerability-reproduced-immediately-patch-screenconnect-23-9-8https://www.securityweek.com/connectwise-confirms-screenconnect-flaw-under-active-exploitation/