Start with Identity
Subscribe
Identity CVE · Other

CVE-2024-1709ConnectWise ScreenConnect auth bypass via an alternate path

critical · CVSS 10.0CISA KEVActively exploited
Product: ConnectWise ScreenConnectVendor: ConnectWiseCWE-288Disclosed: 2024-02-19Status: Actively exploitedNVD ↗CISA KEV ↗

What broke

ConnectWise ScreenConnect through 23.9.7 left an alternate SetupWizard path that did not require authentication (CWE-288). An unauthenticated caller finished setup again and created an administrator. Huntress reproduced it the day of disclosure (19 February 2024). CISA added it to KEV. CVSS 10.0. CVE-2024-1708 is the companion path traversal. Together they are RCE.

Why it matters

ScreenConnect is how MSPs and internal IT remote into everything. An auth bypass there is a meta-IdP, the same class as N-able N-central and PaperCut. Exploitation started immediately. "We will patch next change window" was the wrong sentence.

What to do

  • Upgrade to ScreenConnect 23.9.8 or later. If the box was internet-facing on 19-21 February 2024, rebuild it.
  • Hunt for admin users created through SetupWizard, unexpected extensions, and new remote sessions.
  • Take the management UI off the internet. Put it behind phishing-resistant MFA and a jump path.

Sources

Related identity CVEs

Know a primary source we should add, or a patch status that has changed? Email [email protected]. See all briefs in the identity CVE catalog, or volunteer as a CVE Analyst.
Compiled from vendor advisories, NVD, CISA KEV, and public research. CVSS figures can disagree across NVD and the CNA. Confirm affected versions against the vendor advisory before you patch. Independent, community-driven analysis. See the disclaimer.