CVE-2024-1709

🔥 Known Exploited (CISA KEV)CRITICAL

10.0

CVSS Severity Score

EPSS Score0.0000%

EPSS Percentile0.00th

Published2024-02-21

Last Modified2026-06-17

Data SourcesNVDCISA KEV

Vulnerability Description

ConnectWise ScreenConnect 23.9.7 and prior are affected by an Authentication Bypass Using an Alternate Path or Channel vulnerability, which may allow an attacker direct access to confidential information or critical systems.

Affected Platforms (CPE)

📦

Connectwise

Screenconnect

< 23.9.8

References & Advisories

🔗 https://github.com/rapid7/metasploit-framework/pull/18870

🔗 https://github.com/watchtowrlabs/connectwise-screenconnect_auth-bypass-add-user-poc

🔗 https://techcrunch.com/2024/02/21/researchers-warn-high-risk-connectwise-flaw-under-attack-is-embarrassingly-easy-to-exploit/

🔗 https://www.bleepingcomputer.com/news/security/connectwise-urges-screenconnect-admins-to-patch-critical-rce-flaw/

🔗 https://www.connectwise.com/company/trust/security-bulletins/connectwise-screenconnect-23.9.8

🔗 https://www.horizon3.ai/attack-research/red-team/connectwise-screenconnect-auth-bypass-deep-dive/

🔗 https://www.huntress.com/blog/a-catastrophe-for-control-understanding-the-screenconnect-authentication-bypass

🔗 https://www.huntress.com/blog/detection-guidance-for-connectwise-cwe-288-2

Vulnerability Description

Affected Platforms (CPE)

Screenconnect

References & Advisories

相关漏洞威胁