Critical ScreenConnect Authentication Bypass Enabled Admin Takeover and RCE

ConnectWise confirmed active exploitation of two critical vulnerabilities in ScreenConnect affecting versions earlier than 23.9.8, led by CVE-2024-1709, an authentication bypass rated CVSS 10.0, and CVE-2024-1708, a path traversal flaw. Researchers reported that attackers could reach the setup wizard, overwrite the internal user database, create administrator accounts, and then abuse the product’s extension mechanism to execute code on the host, including SYSTEM-level remote code execution. ConnectWise said its incident response team had validated compromises, while cloud-hosted instances were updated automatically and on-premises or self-hosted customers were told to upgrade immediately.

Huntress and Rapid7 published technical details showing exploitation was straightforward and urgent, increasing the risk to unpatched systems within hours of disclosure. Huntress said suspicious activity could include unusual requests to SetupWizard.aspx with trailing path segments and unexpected file changes in the App_Extensions directory, where malicious extensions may be planted for persistence or code execution. The vendor’s emergency fix in ScreenConnect 23.9.8 closed both flaws, but the rapid weaponization highlighted the exposure of remote management platforms widely used by enterprises and managed service providers.