CVE-2024-1709

ConnectWise ScreenConnect: Authentication Bypass

As of , CVE-2024-1709 in ConnectWise ScreenConnect is on CISA's list of exploited vulnerabilities: CISA listed it on . Our patch-first group: Patch this week.

Exploited
Yes: CISA listed it on 22 February 2024
US federal deadline
29 February 20247 days after CISA listed it. US federal civilian agencies must fix it by then.
Used in ransomware campaigns
Known
EPSS score
0.99Higher than 99% of the CVEs EPSS scores. EPSS estimates the chance of exploitation activity in the next 30 days.
EPSS when listed
0.00 on 22 February 2024EPSS on the day CISA listed it.
Public exploit
1 Metasploit module
Fix
Vendor advice: www.connectwise.comLinks below, from CISA's entry.

What CISA says to do

Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.

CISA's required action

What the flaw is

ConnectWise ScreenConnect contains an authentication bypass vulnerability that allows an attacker with network access to the management interface to create a new, administrator-level account on affected devices.

CISA's description

ConnectWise ScreenConnect 23.9.7 and prior are affected by an Authentication Bypass Using an Alternate Path or Channel vulnerability, which may allow an attacker direct access to confidential information or critical systems.

The CVE record's description, from cisa-cg

CVE published
21 February 2024
Assigned by
cisa-cg
CVSS
10.0 Critical (CVSS 3.1, from the CNA)
CWE-288
Authentication Bypass Using an Alternate Path or Channel
CISA SSVC, exploitation
active
CISA SSVC, automatable
yes
CISA SSVC, technical impact
total

Timeline

  1. The CVE record was published.
  2. CISA added it to its list of exploited vulnerabilities.
  3. The US federal deadline to fix it.

Public exploits

Facts from Metasploit's module list and Exploit-DB's index; we never copy exploit code.

  • Metasploit: ConnectWise ScreenConnect Unauthenticated Remote Code Executionexploit module, rank excellent

ScreenConnect: other exploited entries

VulnerabilityProductOur groupListedDeadlineEPSS
CVE-2024-1708Path TraversalConnectWise ScreenConnectPatch nowRansomware use, listed within a year; Metasploit module0.95
CVE-2026-84869Improper Privilege Management and Missing AuthorizationConnectWise ScreenConnectPatch nowForensic triage required by CISA0.01
CVE-2025-3935Improper AuthenticationConnectWise ScreenConnectPatch soon0.04

Read further