ScreenConnect - Authentication Bypass (CVE-2024-1709)
Description
ConnectWise ScreenConnect 23.9.7 and prior are affected by an Authentication Bypass Using an Alternate Path or Channel
vulnerability, which may allow an attacker direct access to confidential information or
critical systems.
psychologyCrowdSec Analysis
CVE-2024-1709 is a critical authentication bypass vulnerability in ConnectWise ScreenConnect, enabling attackers to access confidential information or critical systems without proper authorization.
CrowdSec has been tracking this vulnerability and its exploits since 15th of December 2023.
CrowdSec network data shows that most actors exploiting CVE-2024-1709 rely on broad, untargeted scans with minimal filtering. The activity is largely automated and opportunistic in nature. Additionally, according to week-over-week analysis by CrowdSec, exploitation of CVE-2024-1709 is surging. Attack volumes are spiking well above historical norms, indicating widespread and escalating interest from threat actors. CVE-2024-1709 is currently experiencing high visibility and active exploitation across the internet.
Indicators of exploitation typically involve access to URLs containing /setupwizard.aspx/.
Full Intelligence Available
Connect your API key to access CrowdSec scores, exploit timelines, and attacker IPs.
| Event | Date |
|---|---|
| Rule Released | 2023-12-15 |
| CVE Published | 2024-02-21 |
| CISA KEV | 2024-02-22 |
| CISA Remediation Deadline | 2024-02-29 |
| CrowdSec First Seen | 2025-04-07 |
Remediation & Protection
External References
- https://www.connectwise.com/company/trust/security-bulletins/connectwise-screenconnect-23.9.8
- https://www.huntress.com/blog/vulnerability-reproduced-immediately-patch-screenconnect-23-9-8
- https://www.huntress.com/blog/detection-guidance-for-connectwise-cwe-288-2
- https://github.com/watchtowrlabs/connectwise-screenconnect_auth-bypass-add-user-poc
- https://github.com/rapid7/metasploit-framework/pull/18870
- https://techcrunch.com/2024/02/21/researchers-warn-high-risk-connectwise-flaw-under-attack-is-embarrassingly-easy-to-exploit/
- https://www.huntress.com/blog/a-catastrophe-for-control-understanding-the-screenconnect-authentication-bypass
- https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2024/CVE-2024-1709.yaml