CVE-2024-1709
📋 TL;DR
CVE-2024-1709 is an authentication bypass vulnerability in ConnectWise ScreenConnect that allows attackers to access administrative functions without valid credentials. This affects all organizations using ScreenConnect versions 23.9.7 and earlier. Attackers can create new administrative accounts and gain full control of affected systems.
💻 Affected Systems
- ConnectWise ScreenConnect
📦 What is this software?
Screenconnect by Connectwise
⚠️ Risk & Real-World Impact
Worst Case
Complete compromise of ScreenConnect server leading to ransomware deployment, data exfiltration, and lateral movement into connected networks.
Likely Case
Attackers create backdoor admin accounts, install malware, and steal sensitive data from connected systems.
If Mitigated
Limited impact if system is isolated, monitored, and has additional authentication layers, though risk remains high due to auth bypass.
🎯 Exploit Status
Multiple public proof-of-concept exploits exist and are being actively used in attacks. Exploitation requires minimal technical skill.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: 23.9.8 or later
Vendor Advisory: https://www.connectwise.com/company/trust/security-bulletins/connectwise-screenconnect-23.9.8
Restart Required: Yes
Instructions:
1. Download ScreenConnect 23.9.8+ from ConnectWise portal. 2. Backup current installation. 3. Run installer as administrator. 4. Restart ScreenConnect service. 5. Verify version in web interface.
🔧 Temporary Workarounds
Network Isolation
allRestrict network access to ScreenConnect server using firewall rules
# Windows: netsh advfirewall firewall add rule name="Block ScreenConnect" dir=in action=block protocol=TCP localport=8040,8041,8042
# Linux: iptables -A INPUT -p tcp --dport 8040:8042 -j DROP
IP Allowlisting
allOnly allow trusted IP addresses to access ScreenConnect
# Windows: netsh advfirewall firewall add rule name="Allow ScreenConnect" dir=in action=allow protocol=TCP localport=8040,8041,8042 remoteip=192.168.1.0/24
# Linux: iptables -A INPUT -p tcp --dport 8040:8042 -s 192.168.1.0/24 -j ACCEPT
🧯 If You Can't Patch
- Immediately take ScreenConnect servers offline or disconnect from network
- Implement strict network segmentation and monitor for suspicious authentication attempts
🔍 How to Verify
Check if Vulnerable:
Check ScreenConnect version in web interface under Setup → About. If version is 23.9.7 or lower, system is vulnerable.Check Version:
# PowerShell: Get-WmiObject -Class Win32_Product | Where-Object {$_.Name -like "*ScreenConnect*"} | Select-Object Name, VersionVerify Fix Applied:
Verify version shows 23.9.8 or higher in web interface. Test authentication by attempting to access administrative functions without valid credentials.📡 Detection & Monitoring
Log Indicators:
- Unexpected admin user creation
- Failed authentication attempts followed by successful access
- Access from unusual IP addresses to administrative endpoints
Network Indicators:
- HTTP POST requests to /SetupWizard.aspx or /Administration/* endpoints from unauthorized sources
- Traffic to ScreenConnect default ports (8040-8042) from unexpected locations
SIEM Query:
source="screenconnect.log" AND (event="UserCreated" OR uri_path="/SetupWizard*" OR status_code=200 AND auth_failure=1)🔗 References
- https://github.com/rapid7/metasploit-framework/pull/18870
- https://github.com/watchtowrlabs/connectwise-screenconnect_auth-bypass-add-user-poc
- https://techcrunch.com/2024/02/21/researchers-warn-high-risk-connectwise-flaw-under-attack-is-embarrassingly-easy-to-exploit/
- https://www.bleepingcomputer.com/news/security/connectwise-urges-screenconnect-admins-to-patch-critical-rce-flaw/
- https://www.connectwise.com/company/trust/security-bulletins/connectwise-screenconnect-23.9.8
- https://www.horizon3.ai/attack-research/red-team/connectwise-screenconnect-auth-bypass-deep-dive/
- https://www.huntress.com/blog/a-catastrophe-for-control-understanding-the-screenconnect-authentication-bypass
- https://www.huntress.com/blog/detection-guidance-for-connectwise-cwe-288-2
- https://www.huntress.com/blog/vulnerability-reproduced-immediately-patch-screenconnect-23-9-8
- https://www.securityweek.com/connectwise-confirms-screenconnect-flaw-under-active-exploitation/
- https://github.com/rapid7/metasploit-framework/pull/18870
- https://github.com/watchtowrlabs/connectwise-screenconnect_auth-bypass-add-user-poc
- https://techcrunch.com/2024/02/21/researchers-warn-high-risk-connectwise-flaw-under-attack-is-embarrassingly-easy-to-exploit/
- https://www.bleepingcomputer.com/news/security/connectwise-urges-screenconnect-admins-to-patch-critical-rce-flaw/
- https://www.connectwise.com/company/trust/security-bulletins/connectwise-screenconnect-23.9.8
- https://www.horizon3.ai/attack-research/red-team/connectwise-screenconnect-auth-bypass-deep-dive/
- https://www.huntress.com/blog/a-catastrophe-for-control-understanding-the-screenconnect-authentication-bypass
- https://www.huntress.com/blog/detection-guidance-for-connectwise-cwe-288-2
- https://www.huntress.com/blog/vulnerability-reproduced-immediately-patch-screenconnect-23-9-8
- https://www.securityweek.com/connectwise-confirms-screenconnect-flaw-under-active-exploitation/
- https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2024-1709
