CVE-2024-1709:

Authentication bypass vulnerability in ConnectWise ScreenConnect <= 23.9.7 (patched in 23.9.8) that allows a remote attacker to bypass authentication via an alternate path or channel, potentially gaining direct access to confidential information and critical systems.

Score
A numerical rating that indicates how dangerous this vulnerability is.

10.0Critical

Published Date:Feb 21, 2024
CISA KEV Date:Feb 22, 2024
Industries Affected:20

Armis Early Warning:

1 Days

Threat Predictions

EPSS Score:94.3
EPSS Percentile:100%

Exploitability

Score:3.9
Attack Vector:NETWORK
Attack Complexity:LOW
Privileges Required:NONE
User Interaction:NONE
Scope:CHANGED

Impact

Score:6.0
Confidentiality Impact:HIGH
Integrity Impact:HIGH
Availability Impact:HIGH

Description Preview

Overview

This CVE describes a high-severity authentication bypass in ConnectWise ScreenConnect prior to 23.9.8. The flaw allows an attacker to bypass authentication through an alternate path or channel, resulting in direct access to confidential data or critical systems without requiring user interaction. The issue is rated critical (CVSS 3.1: AV network, AC low, PR none, UI none, SC changed, C/H/I/A high) and was publicly disclosed with active exploitation reported in multiple security outlets prior to the patch.

Remediation

Upgrade to ScreenConnect to version 23.9.8 or newer as soon as possible, following the vendor’s upgrade and patching guidance.
If immediate upgrade is not feasible, implement compensating controls to reduce exposure:
Limit exposure by placing ScreenConnect behind a VPN or restricting access via a firewall and IP allowlists.
Disable or tightly restrict external/public access to the ScreenConnect admin interfaces.
Enforce network segmentation and least privilege for management components.
After patching, verify the update to ensure the version is 23.9.8 or newer and that the remediation is in place.
Monitor security logs and alerts for indicators of exploitation or anomalous authentication attempts; search for new admin accounts, unusual login times, or configuration changes.
Consider additional hardening steps (if not already in place): implement MFA where supported, rotate credentials, and ensure regular backups and an incident response plan.
Review vendor advisories and CVE-specific guidance to validate any environment-specific mitigations.