EXPLOIT 🔴 1×KEV
CVE-2024-1708 in ConnectWise ScreenConnect: CISA KEV Confirms Active Exploitation
- CVE-2024-1708 is an authentication bypass vulnerability in ConnectWise ScreenConnect versions 23.9.7 and earlier.
- CONFIRMED active exploitation in the wild, leading to its addition to the CISA Known Exploited Vulnerabilities (KEV) catalog. EPSS score is high at 0.8162.
- Immediate action required: Patch all vulnerable instances to version 23.9.8 or later. Prioritize publicly-facing servers.
Technical Analysis
CONFIRMED reports indicate active exploitation of CVE-2024-1708, an authentication bypass vulnerability in ConnectWise ScreenConnect. The flaw exists within the setup wizard component, which can be accessed by a remote, unauthenticated attacker on an exposed instance. By navigating to a specific path, an attacker can create a new administrator-level user, establishing an initial ingress point. Threat actors are REPORTEDLY chaining this vulnerability with a path traversal flaw (CVE-2024-1709) to achieve remote code execution (RCE). The combined attack chain allows for complete server takeover, deployment of secondary payloads like ransomware, and subsequent lateral movement into networks managed via the ScreenConnect instance.
Affected Systems
- ScreenConnect 23.9.7 and earlier
Intelligence Context
The addition of CVE-2024-1708 to the CISA KEV catalog is the primary signal for immediate action, as it CONFIRMS active, in-the-wild exploitation. The high EPSS score of 0.8162 further quantifies the high probability of exploitation activity. The 'ZERO-DAY RACE' classification indicates that exploitation was observed before or concurrently with the public disclosure, giving defenders minimal time to react. The absence of a CVSS score should be disregarded; the KEV status is a more definitive indicator of real-world risk and mandates prioritization for all organizations using the affected software, not just the federal agencies bound by the CISA directive.
Remediation & Defense
- If immediate patching is not possible, restrict access to the ScreenConnect web interface to trusted IP addresses via firewall rules.
- Remove the vulnerable SetupWizard.aspx file if it exists on the server.
- Review web server logs for requests to '/SetupWizard.aspx'.
- Monitor for the creation of unexpected administrator-level accounts within ScreenConnect.
- Look for suspicious child processes spawned by the ScreenConnect server process.
Source Timeline
- thehackernews.com — First reporter
- bleepingcomputer.com — Corroborating source
- cisa.gov — Official KEV entry