CVE-2024-1708

Published Feb 21, 2024

Last updated a month ago

Exploit known CVSS high 8.4

VDI

Cloud

Network

Zero-day

Port (443)

Overview

AI description

Automated description summarized from trusted sources.

CVE-2024-1708 is a path traversal vulnerability affecting ConnectWise ScreenConnect versions up to 23.9.7. This flaw allows an attacker to manipulate file paths, potentially gaining unauthorized access to files or directories located outside the intended restricted directory. Specifically, it is described as a "Zip Slip" vulnerability within the ScreenConnect extension handling mechanism, where vulnerable versions failed to properly validate filenames within a zip archive during extension uploads. This manipulation could lead to remote code execution or compromise sensitive data and critical systems. It is often exploited in conjunction with CVE-2024-1709, an authentication bypass vulnerability.

Description: ConnectWise ScreenConnect 23.9.7 and prior are affected by path-traversal vulnerability, which may allow an attacker the ability to execute remote code or directly impact confidential data or critical systems.
Source: 9119a7d8-5eab-497f-8521-727c672e3725
NVD status: Analyzed
Products: screenconnect

Risk scores

CVSS 3.1

Type: Primary
Base score: 8.4
Impact score: 6
Exploitability score: 1.7
Vector string: CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:H/I:H/A:H
Severity: HIGH

Known exploits

Data from CISA

Vulnerability name: ConnectWise ScreenConnect Path Traversal Vulnerability
Exploit added on: Apr 28, 2026
Exploit action due: May 12, 2026
Required action: Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.

Weaknesses

9119a7d8-5eab-497f-8521-727c672e3725: CWE-22
nvd@nist.gov: CWE-22

Hype score: Not currently trending

Configurations

[
  {
    "nodes": [
      {
        "cpeMatch": [
          {
            "criteria": "cpe:2.3:a:connectwise:screenconnect:*:*:*:*:*:*:*:*",
            "matchCriteriaId": "26FEBC12-2B0F-4F8F-BCB8-03683D71B37F",
            "versionEndExcluding": "23.9.8",
            "vulnerable": true
          }
        ],
        "negate": false,
        "operator": "OR"
      }
    ]
  }
]

References

Sources include official advisories and independent security research.