Critical severity · published Feb 21, 2024
CVE-2024-1709
Authentication bypass using an alternate path or channel
RansomwareIn wildKEV
10.0
CVSS
100%
EPSS
Yes
On KEV
Description
ConnectWise ScreenConnect 23.9.7 and prior are affected by an Authentication Bypass Using an Alternate Path or Channel
vulnerability, which may allow an attacker direct access to confidential information or
critical systems.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H
Attack vector
Network
Complexity
Low
Privileges
None
User interaction
None
Confidentiality
High
Integrity
High
Availability
High
Scope
Changed
Exploitation
Is it being used?
Exploit prediction (EPSS)100.0% · higher than 100% of CVEs
Exploited in the wildYes
CISA KEVListed Feb 22, 2024
Federal remediation dueFeb 29, 2024
Ransomware campaign useKnown
Affected products
Which versions
SC
ScreenConnect · ConnectWise
through 23.9.7 · source: vendor, NVD, CISA, KEV
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2024-1709
CVE.org
https://www.cve.org/CVERecord?id=CVE-2024-1709
CISA KEV catalogue
https://www.cisa.gov/known-exploited-vulnerabilities-catalog
www.connectwise.com
https://www.connectwise.com/company/trust/security-bulletins/connectwise-screenconnect-23.9.8
www.huntress.com
https://www.huntress.com/blog/vulnerability-reproduced-immediately-patch-screenconnect-23-9-8
www.huntress.com
https://www.huntress.com/blog/detection-guidance-for-connectwise-cwe-288-2
www.bleepingcomputer.com
https://www.bleepingcomputer.com/news/security/connectwise-urges-screenconnect-admins-to-patch-critical-rce-flaw/
github.com
https://github.com/watchtowrlabs/connectwise-screenconnect_auth-bypass-add-user-poc
github.com
https://github.com/rapid7/metasploit-framework/pull/18870
More from ScreenConnect
9.9
CVE-2026-84869
ScreenConnect Client: Guest-to-Host File Execution via File-Transfer Actions
8.4
CVE-2024-1708
Improper limitation of a pathname to a restricted directory (“path traversal”)
7.2
CVE-2025-3935
ScreenConnect Exposure to ASP.NET ViewState Code Injection
9.8
CVE-2023-25718
In ConnectWise Control through 22.9.10032 (formerly known as ScreenConnect), after an executable file is signed, additional instructions can be added without invalidating the…
9.8
CVE-2019-16517
An issue was discovered in ConnectWise Control (formerly known as ScreenConnect) 19.3.25270.7185