CVE-2024-1708
ConnectWise ScreenConnect Path Traversal Vulnerability
Description
CVE-2024-1708 is a HIGH severity path traversal vulnerability in ConnectWise ScreenConnect, a widely deployed remote support and remote access platform, with a CVSS 3.1 score of 8.4. The flaw allows an authenticated attacker to traverse outside the intended directory, enabling arbitrary file access and remote code execution against ScreenConnect 23.9.7 and earlier. CVE-2024-1708 was famously chained with CVE-2024-1709, an authentication bypass, turning the combined attack into an unauthenticated remote takeover that has been weaponized by the Storm-1175 group as part of high-tempo Medusa ransomware operations. CISA added CVE-2024-1708 to the KEV catalog on April 28, 2026, with a remediation deadline of May 12, 2026, after observing renewed exploitation against unpatched on-premises servers. With an EPSS score of 0.537 (98th percentile), exploitation activity is highly active.
KEV Information
CVSS Score
CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:H/I:H/A:HOpen in CalculatorAffected Products
| Vendor | Product | Version |
|---|---|---|
| connectwise | screenconnect | < 23.9.8 |
Multiple CVSS Assessments
CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:H/I:H/A:H
CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:H/I:H/A:H
References
- https://www.connectwise.com/company/trust/security-bulletins/connectwise-screenconnect-23.9.8(Vendor Advisory)
- https://www.huntress.com/blog/a-catastrophe-for-control-understanding-the-screenconnect-authentication-bypass(Exploit, Third Party Advisory)
- https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2024-1708(Third Party Advisory, US Government Resource)
- https://www.microsoft.com/en-us/security/blog/2026/04/06/storm-1175-focuses-gaze-on-vulnerable-web-facing-assets-in-high-tempo-medusa-ransomware-operations/(Technical Description)
Weakness Type
CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')
Path Traversal is a vulnerability that occurs when software uses external input to construct a pathname intended to identify a file or directory beneath a restricted parent directory, but fails to neutralize sequences such as ../ that allow the path to resolve to locations outside that directory. In ConnectWise ScreenConnect, the vulnerable code path accepted attacker-controlled file names during extension/sub-application handling without sufficiently constraining the resulting filesystem path, allowing files to be written or read outside the intended ScreenConnect application directory. When combined with CVE-2024-1709 (an authentication bypass in the SetupWizard endpoint), an unauthenticated attacker can drop a malicious ASP.NET file into the web-served path and trigger remote code execution under the ScreenConnect service account.
Learn more: CWE-22 — Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')
Impact Analysis
CVE-2024-1708 carries a CVSS 3.1 score of 8.4 (HIGH) with the vector AV:N/AC:L/PR:H/UI:R/S:C/C:H/I:H/A:H, meaning the issue is remotely exploitable over the network with low attack complexity, but on its own requires a privileged authenticated session. The Scope:Changed component is significant: a successful exploit can affect resources beyond the ScreenConnect process, including the underlying server filesystem and any endpoints managed through the platform. Confidentiality, Integrity and Availability are all rated High because path traversal in ScreenConnect translates directly into arbitrary file write, which is sufficient to plant a web shell, replace configuration data, and pivot into managed customer environments. In real-world incidents, attackers chained CVE-2024-1708 with CVE-2024-1709 to bypass authentication entirely, dropping ransomware payloads through the ScreenConnect agent network — making this effectively an unauthenticated remote code execution against a high-trust IT management surface.
Exploit Maturity
Public exploit code and detailed technical analysis are available for CVE-2024-1708. The Huntress team published a deep technical write-up — see "A Catastrophe for Control: Understanding the ScreenConnect Authentication Bypass" — including details on how to reach the vulnerable code path. CISA confirmed active exploitation by adding CVE-2024-1708 to the KEV catalog on April 28, 2026, and Microsoft Threat Intelligence has documented the Storm-1175 actor abusing ScreenConnect during high-tempo Medusa ransomware operations as recently as April 2026 (Microsoft Security Blog). With an EPSS score of 0.537 (98th percentile), the model rates this vulnerability as having a near-certain probability of continued exploitation in the next 30 days; defenders running on-premises ScreenConnect should treat any unpatched instance as already compromised until proven otherwise.
Remediation
- Apply mitigations per vendor instructions. Upgrade ConnectWise ScreenConnect to version 23.9.8 or later, which fixes both CVE-2024-1708 and the chained CVE-2024-1709 authentication bypass. ConnectWise Cloud customers were patched automatically; on-premises customers must update manually following the ConnectWise security bulletin. Discontinue use of the product if mitigations cannot be applied, as required by CISA BOD 22-01.
- Restrict ScreenConnect server exposure. Place on-premises ScreenConnect servers behind a VPN or restrict access to known administrative IP ranges. The SetupWizard, login, and extension management endpoints should never be reachable from arbitrary internet sources.
- Hunt for indicators of compromise. Review the ScreenConnect installation directory (typically
C:\Program Files (x86)\ScreenConnect) for unexpected.aspx,.ashxor extension files modified after the patch cycle. Inspect IIS logs for requests toSetupWizard.aspxand unusual extension upload paths. CheckUser.xmlfor newly created admin accounts. - Rotate credentials and assume agent compromise. Treat all credentials, API keys, and certificates stored in the ScreenConnect server (and any endpoints reached through it) as potentially exposed. Force password resets, rotate session tokens, and re-issue API keys.
- Harden against path traversal long-term. Ensure web servers and application stacks normalize paths before access, enforce least-privilege filesystem permissions on the service account, and deploy WAF or application-layer rules that block
..sequences in file-name parameters — see the CWE-22 mitigation guidance for additional defensive controls.
Technical Details
CVE-2024-1708 is a path traversal flaw (CWE-22) in ConnectWise ScreenConnect 23.9.7 and prior, exposed through the application's extension and sub-application handling logic. The vulnerable code constructs a filesystem path using attacker-influenced input without canonicalizing the result against the ScreenConnect application root, allowing .. segments to escape the intended directory. The CVSS 3.1 vector AV:N/AC:L/PR:H/UI:R/S:C/C:H/I:H/A:H reflects that the request is delivered over HTTP(S) with low complexity, but normally requires an authenticated administrative session — until the attacker chains CVE-2024-1709 to forge the SetupWizard authentication state and reach the same code path unauthenticated. Once exploited, the attacker can write a .aspx payload into a web-served directory (such as the ScreenConnect web root or App_Extensions), and IIS will execute the file in the context of the ScreenConnect service account, which by default has wide control over the host. Because ScreenConnect is a remote management platform, the Scope:Changed rating is operationally meaningful: code execution on the server provides a launchpad to deliver commands or files to every connected endpoint, which is exactly how Storm-1175 leveraged the chain to deploy Medusa ransomware across managed estates.
Frequently Asked Questions
Is CVE-2024-1708 being actively exploited?
Yes. CISA added CVE-2024-1708 to the Known Exploited Vulnerabilities catalog on April 28, 2026, and Microsoft has linked the ConnectWise ScreenConnect chain to the Storm-1175 actor running Medusa ransomware operations in 2026. The EPSS score of 0.537 (98th percentile) indicates ongoing, widespread exploitation activity.
What products are affected by CVE-2024-1708?
ConnectWise ScreenConnect versions 23.9.7 and earlier are vulnerable. The fix ships in ScreenConnect 23.9.8. Cloud-hosted ScreenConnect instances were updated automatically; on-premises deployments must be patched manually.
How do I fix CVE-2024-1708?
Upgrade to ScreenConnect 23.9.8 or later, restrict management interfaces to trusted networks, hunt for web shells and unauthorized admin accounts in the ScreenConnect installation directory, and rotate any credentials or API keys that were stored on or accessed through the server.
How severe is CVE-2024-1708?
CVE-2024-1708 is rated HIGH (CVSS 3.1 score 8.4) with full High impact on Confidentiality, Integrity, and Availability and a Scope:Changed rating. Combined with the EPSS 98th-percentile score and confirmed in-the-wild ransomware use, defenders should treat any unpatched on-premises ScreenConnect server as a critical-priority remediation.
Need Help With Vulnerability Management?
Our security experts can help you prioritize and remediate vulnerabilities effectively.