CVE-2024-1709

Published Feb 21, 2024

Last updated 7 months ago

Exploit known CVSS critical 10.0

Overview

Description: ConnectWise ScreenConnect 23.9.7 and prior are affected by an Authentication Bypass Using an Alternate Path or Channel vulnerability, which may allow an attacker direct access to confidential information or critical systems.
Source: 9119a7d8-5eab-497f-8521-727c672e3725
NVD status: Analyzed
Products: screenconnect

Risk scores

CVSS 3.1

Type: Primary
Base score: 10
Impact score: 6
Exploitability score: 3.9
Vector string: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H
Severity: CRITICAL

Known exploits

Data from CISA

Vulnerability name: ConnectWise ScreenConnect Authentication Bypass Vulnerability
Exploit added on: Feb 22, 2024
Exploit action due: Feb 29, 2024
Required action: Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.

Weaknesses

9119a7d8-5eab-497f-8521-727c672e3725: CWE-288
nvd@nist.gov: NVD-CWE-Other

Hype score: Not currently trending

Configurations

[
  {
    "nodes": [
      {
        "negate": false,
        "cpeMatch": [
          {
            "criteria": "cpe:2.3:a:connectwise:screenconnect:*:*:*:*:*:*:*:*",
            "vulnerable": true,
            "matchCriteriaId": "26FEBC12-2B0F-4F8F-BCB8-03683D71B37F",
            "versionEndExcluding": "23.9.8"
          }
        ],
        "operator": "OR"
      }
    ]
  }
]

References

Sources include official advisories and independent security research.

Overview

Risk scores

CVSS 3.1

Known exploits

Weaknesses

Social media

Configurations

References