CVE-2024-1709
ConnectWise ScreenConnect Authentication Bypass Vulnerability
Description
CVE-2024-1709 is a critical authentication bypass vulnerability (CWE-288: Authentication Bypass Using an Alternate Path or Channel) in ConnectWise ScreenConnect versions 23.9.7 and earlier. The flaw allows an unauthenticated remote attacker to bypass the authentication mechanism entirely, gaining direct access to confidential information or critical systems without any credentials. With a maximum CVSS score of 10.0 and an EPSS score of 94.3% (99.9th percentile), CVE-2024-1709 represents one of the most actively exploited vulnerabilities in the current threat landscape. CISA has confirmed active exploitation in the wild, and this vulnerability has a confirmed link to ransomware campaigns, making immediate remediation essential for all ScreenConnect deployments.
KEV Information
CVSS Score
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:HOpen in CalculatorCWEs
Affected Products
| Vendor | Product | Version |
|---|---|---|
| connectwise | screenconnect | < 23.9.8 |
Multiple CVSS Assessments
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H
References
- https://github.com/rapid7/metasploit-framework/pull/18870(Issue Tracking, Patch, Third Party Advisory)
- https://github.com/watchtowrlabs/connectwise-screenconnect_auth-bypass-add-user-poc(Exploit, Third Party Advisory)
- https://techcrunch.com/2024/02/21/researchers-warn-high-risk-connectwise-flaw-under-attack-is-embarrassingly-easy-to-exploit/(Press/Media Coverage, Third Party Advisory)
- https://www.bleepingcomputer.com/news/security/connectwise-urges-screenconnect-admins-to-patch-critical-rce-flaw/(Press/Media Coverage, Third Party Advisory)
- https://www.connectwise.com/company/trust/security-bulletins/connectwise-screenconnect-23.9.8(Vendor Advisory)
- https://www.horizon3.ai/attack-research/red-team/connectwise-screenconnect-auth-bypass-deep-dive/(Third Party Advisory)
- https://www.huntress.com/blog/a-catastrophe-for-control-understanding-the-screenconnect-authentication-bypass(Exploit, Third Party Advisory)
- https://www.huntress.com/blog/detection-guidance-for-connectwise-cwe-288-2(Exploit, Third Party Advisory)
- https://www.huntress.com/blog/vulnerability-reproduced-immediately-patch-screenconnect-23-9-8(Third Party Advisory)
- https://www.securityweek.com/connectwise-confirms-screenconnect-flaw-under-active-exploitation/(Press/Media Coverage, Third Party Advisory)
- https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2024-1709(US Government Resource)
Weakness Type
CWE-288: Authentication Bypass Using an Alternate Path or Channel
CWE-288 describes a weakness where authentication can be circumvented by using an alternative access path or channel that does not enforce the same authentication controls as the primary interface. In CVE-2024-1709, ConnectWise ScreenConnect fails to enforce authentication on an alternate URL path or setup channel, allowing attackers to bypass the login mechanism entirely and gain unauthenticated access to protected functionality and systems.
Learn more: CWE-288 — Authentication Bypass Using an Alternate Path or Channel
Impact Analysis
CVE-2024-1709 is rated CRITICAL with a perfect CVSS 3.1 score of 10.0, reflecting the most severe possible impact. The vulnerability is remotely exploitable without any authentication and requires no user interaction, meaning attackers can exploit it entirely over the network with no victim involvement. Scope (Changed): Successful exploitation can affect resources beyond the ScreenConnect application itself, as the attacker gains access to managed endpoints and systems connected through the remote management platform. Confidentiality (High): All data managed through ScreenConnect, including credentials and system configurations, is exposed. Integrity (High): Attackers can deploy malicious software or modify systems across all managed endpoints. Availability (High): Connected systems can be disrupted or taken offline. The EPSS score of 94.3% (99.9th percentile) confirms near-certain active exploitation, and the confirmed ransomware connection means compromised ScreenConnect instances are actively being weaponized for ransomware attacks.
Exploit Maturity
CVE-2024-1709 has an extremely mature and active exploit ecosystem. CISA has confirmed active exploitation in the wild, and the vulnerability has been directly linked to ransomware operations. Public exploit code is available for CVE-2024-1709 via Huntress Labs and GitHub (WatchTowr Labs PoC), with additional detection guidance published by Huntress. The EPSS score of 94.3% (99.9th percentile) indicates that exploitation is near-certain — multiple security researchers described this flaw as "embarrassingly easy to exploit." The flaw was also integrated into Metasploit, further lowering the technical barrier for attackers. Any ScreenConnect deployment running version 23.9.7 or earlier should be treated as compromised until patched and reviewed.
Remediation
- Upgrade ConnectWise ScreenConnect to version 23.9.8 or later immediately. CISA's required action states: "Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable." The vendor security bulletin is available at https://www.connectwise.com/company/trust/security-bulletins/connectwise-screenconnect-23.9.8.
- If immediate upgrading is not possible, take the ScreenConnect server offline or restrict access to trusted IP ranges only via firewall rules, as the vulnerability is remotely exploitable without authentication.
- After patching, audit all ScreenConnect user accounts for unauthorized additions — exploit code targeting this CVE specifically demonstrates the ability to add unauthorized admin accounts. Remove any accounts not recognized by your organization.
- Review logs for signs of exploitation, including unexpected setup page access, new account creation events, and unusual remote session activity. Check for evidence of ransomware staging or lateral movement across managed endpoints.
- Long-term, enforce network segmentation for remote management infrastructure: restrict ScreenConnect server access to management VLANs and apply multi-factor authentication on all administrative interfaces where supported.
Technical Details
CVE-2024-1709 exploits an authentication bypass via an alternate path or channel (CWE-288) in the ConnectWise ScreenConnect web application. The vulnerability exists because the ScreenConnect setup or installation path does not enforce the same authentication controls as the standard application interface, allowing an unauthenticated attacker to access restricted setup functionality directly. The CVSS vector (AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H) confirms the vulnerability is trivially exploitable from the network with no authentication or user interaction, and that the scope is changed — meaning exploitation can impact systems and resources beyond the ScreenConnect server itself, including all managed remote endpoints. The Metasploit module integration and multiple published PoC exploits demonstrate that the attack is straightforward and reliably reproducible, with researchers noting the setup endpoint can be used to create a new administrative user, granting full control over the ScreenConnect instance.
Frequently Asked Questions
Is CVE-2024-1709 being actively exploited?
Yes. CVE-2024-1709 is confirmed by CISA as actively exploited in the wild and is linked to ransomware campaigns. The EPSS score of 94.3% (99.9th percentile) represents near-certain exploitation activity. Multiple security firms observed widespread exploitation in the wild shortly after the vulnerability was disclosed, and public exploit code was rapidly released by multiple researchers.
What products are affected by CVE-2024-1709?
CVE-2024-1709 affects ConnectWise ScreenConnect versions 23.9.7 and earlier. All deployments of ScreenConnect — both cloud-hosted by ConnectWise and self-hosted on-premises instances — running affected versions are vulnerable to unauthenticated remote exploitation.
How do I fix CVE-2024-1709?
Upgrade ConnectWise ScreenConnect to version 23.9.8 or later immediately using the vendor patch available at https://www.connectwise.com/company/trust/security-bulletins/connectwise-screenconnect-23.9.8. If upgrading is not immediately possible, take the server offline or restrict access to trusted networks only. After patching, audit all user accounts and review logs for signs of prior exploitation.
How severe is CVE-2024-1709?
CVE-2024-1709 is rated CRITICAL with a CVSS 3.1 score of 10.0 — the maximum possible score — reflecting unauthenticated remote exploitation with full impact on confidentiality, integrity, and availability, including scope change affecting managed endpoints. The EPSS score of 94.3% (99.9th percentile) confirms this is one of the most actively exploited vulnerabilities currently tracked. Immediate remediation is essential.
Need Help With Vulnerability Management?
Our security experts can help you prioritize and remediate vulnerabilities effectively.