CVE-2024-1709

Published Feb 21, 2024

Last updated 4 months ago

Exploit known CVSS critical 10.0

VDI

Network

Zero-day

HTTP

Overview

AI description

Automated description summarized from trusted sources.

CVE-2024-1709 is a critical authentication bypass vulnerability affecting ConnectWise ScreenConnect versions up to 23.9.7. Classified as CWE-288 (Authentication Bypass Using an Alternate Path or Channel), this flaw allows unauthorized attackers to circumvent authentication mechanisms. It achieves this by exploiting a weakness in how ScreenConnect's .NET framework processes URL paths, enabling attackers to manipulate these paths to bypass normal authentication checks. This vulnerability can grant unauthenticated attackers direct access to sensitive functionalities or data, including the administrative setup wizard, which would typically require proper authentication. CVE-2024-1709 has been actively exploited in the wild and is listed in CISA's Known Exploited Vulnerabilities Catalog. It is frequently chained with CVE-2024-1708 to achieve remote code execution.

Description: ConnectWise ScreenConnect 23.9.7 and prior are affected by an Authentication Bypass Using an Alternate Path or Channel vulnerability, which may allow an attacker direct access to confidential information or critical systems.
Source: 9119a7d8-5eab-497f-8521-727c672e3725
NVD status: Analyzed
Products: screenconnect

Risk scores

CVSS 3.1

Type: Primary
Base score: 10
Impact score: 6
Exploitability score: 3.9
Vector string: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H
Severity: CRITICAL

Known exploits

Data from CISA

Vulnerability name: ConnectWise ScreenConnect Authentication Bypass Vulnerability
Exploit added on: Feb 22, 2024
Exploit action due: Feb 29, 2024
Required action: Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.

Weaknesses

9119a7d8-5eab-497f-8521-727c672e3725: CWE-288
nvd@nist.gov: NVD-CWE-Other

Hype score: Not currently trending

Configurations

[
  {
    "nodes": [
      {
        "cpeMatch": [
          {
            "criteria": "cpe:2.3:a:connectwise:screenconnect:*:*:*:*:*:*:*:*",
            "matchCriteriaId": "26FEBC12-2B0F-4F8F-BCB8-03683D71B37F",
            "versionEndExcluding": "23.9.8",
            "vulnerable": true
          }
        ],
        "negate": false,
        "operator": "OR"
      }
    ]
  }
]

References

Sources include official advisories and independent security research.