CVE-2024-1708

ConnectWise ScreenConnect 23.9.7 and prior contain a path-traversal flaw (CWE-22, rated 8.4 high) that can allow an attacker to execute remote code or access confidential data and critical systems. Public analysis (Huntress) shows it is triggered by manipulating directory paths in the product's administrative setup wizard, and that it is typically chained with a companion authentication-bypass flaw (CVE-2024-1709) disclosed at the same time to achieve unauthenticated remote code execution on the ScreenConnect server. An attacker who compromises a ScreenConnect server gains control of the remote-access platform itself and can pivot to every endpoint that server manages, making it an efficient foothold for ransomware. Any organization running ScreenConnect 23.9.7 or earlier is affected, most commonly MSPs and IT teams that use the tool to manage client and internal machines. The flaw is being actively exploited in the wild: it is listed in CISA's Known Exploited Vulnerabilities catalog with known ransomware use, EPSS puts the 30-day exploitation probability at 95.5% (100th percentile), and recent reporting ties fast-moving exploitation to the Storm-1175 activity cluster, which drops Medusa ransomware.

What to do: Immediately update all self-hosted ScreenConnect instances to a release newer than 23.9.7 per ConnectWise's advisory, and ensure the companion authentication-bypass flaw (CVE-2024-1709) is patched at the same time; federal agencies must follow BOD 22-01 mitigation timelines per the KEV listing. Because exploitation is fast-moving and linked to ransomware operations, hunt for signs of compromise such as unexpected new administrative accounts, setup-wizard activity, or unusual remote sessions on exposed servers. Separately, ConnectWise has disclosed a breach of its own infrastructure by a nation-state actor, so review vendor communications for any updated guidance.