Critical ConnectWise ScreenConnect Authentication Bypass Exploited in Attacks

ConnectWise disclosed two vulnerabilities affecting ScreenConnect versions 23.9.7 and earlier: CVE-2024-1709, a critical authentication bypass, and CVE-2024-1708, a high-severity path-traversal flaw. The authentication bypass is trivially exploitable, with public proof-of-concept exploits and a Metasploit module for unauthenticated remote code execution available. ConnectWise confirmed compromised accounts, and reported attack indicators include ransomware, Cobalt Strike, malicious loaders, information-stealing malware, and attacker-distributed remote-access installers.

Unit 42 identified 18,188 unique IP addresses hosting ScreenConnect globally as of February 21, 2024, highlighting the potential exposure without establishing that every instance was vulnerable. CISA added CVE-2024-1709 to its Known Exploited Vulnerabilities Catalog and required Federal Civilian Executive Branch agencies to remediate it by February 29, 2024. ConnectWise updated its specified cloud-hosted services and urged self-hosted customers to patch immediately; organizations operating exposed servers should prioritize remediation and investigate for account compromise and malicious remote-access activity.