CVE-2024-1709
CVE-2024-1709 is a critical-severity vulnerability in Connectwise Screenconnect with a CVSS 3.x base score of 10.0. It is listed in CISA's Known Exploited Vulnerabilities (KEV) catalog, confirming it has been exploited in the wild (added 2024-02-22). The underlying weakness is classified as CWE-288.
Key facts
- Severity: Critical (CVSS 3.x base score 10.0)
- EPSS exploit prediction: 100% (100th percentile)
- Actively exploited: Yes — listed in CISA KEV (added 2024-02-22)
- EU (EUVD) id: EUVD-2024-17443
- EU exploitation: Flagged exploited in the ENISA EU Vulnerability Database (since 2024-02-22)
- Weakness: CWE-288
- Affected product: Connectwise Screenconnect
- Published:
- Last modified:
Description
ConnectWise ScreenConnect 23.9.7 and prior are affected by an Authentication Bypass Using an Alternate Path or Channel vulnerability, which may allow an attacker direct access to confidential information or critical systems.
Frequently asked questions
- What is CVE-2024-1709?
- ConnectWise ScreenConnect 23.9.7 and prior are affected by an Authentication Bypass Using an Alternate Path or Channel vulnerability, which may allow an attacker direct access to confidential information or critical systems.
- How severe is CVE-2024-1709?
- CVE-2024-1709 has a CVSS 3.x base score of 10.0, rated critical severity. It is exploitable over network with low attack complexity, requires no privileges and no user interaction. Impact on confidentiality is high, integrity high, and availability high.
- Is CVE-2024-1709 being actively exploited?
- Yes. CVE-2024-1709 is on CISA's Known Exploited Vulnerabilities (KEV) catalog, added on 2024-02-22, which means active exploitation has been confirmed. It should be prioritised for remediation.
- What products are affected by CVE-2024-1709?
- CVE-2024-1709 affects Connectwise Screenconnect. See the affected-products list for the exact vulnerable versions.
- How do I fix CVE-2024-1709?
- Review the linked vendor and NVD advisories for patched versions and mitigations, then upgrade or apply the recommended workaround. Because this CVE is known to be actively exploited, treat remediation as urgent — CISA KEV typically sets a short remediation deadline.
- Does CVE-2024-1709 have an EU (EUVD) identifier?
- Yes. CVE-2024-1709 is tracked in the ENISA EU Vulnerability Database (EUVD) as EUVD-2024-17443. It is also flagged as exploited in the EUVD (since 2024-02-22).
- When was CVE-2024-1709 published?
- CVE-2024-1709 was published on 2024-02-21 and last updated on 2026-06-17.
References
- https://github.com/rapid7/metasploit-framework/pull/18870
- https://github.com/watchtowrlabs/connectwise-screenconnect_auth-bypass-add-user-poc
- https://techcrunch.com/2024/02/21/researchers-warn-high-risk-connectwise-flaw-under-attack-is-embarrassingly-easy-to-exploit/
- https://www.bleepingcomputer.com/news/security/connectwise-urges-screenconnect-admins-to-patch-critical-rce-flaw/
- https://www.connectwise.com/company/trust/security-bulletins/connectwise-screenconnect-23.9.8
- https://www.horizon3.ai/attack-research/red-team/connectwise-screenconnect-auth-bypass-deep-dive/
- https://www.huntress.com/blog/a-catastrophe-for-control-understanding-the-screenconnect-authentication-bypass
- https://www.huntress.com/blog/detection-guidance-for-connectwise-cwe-288-2
- https://www.huntress.com/blog/vulnerability-reproduced-immediately-patch-screenconnect-23-9-8
- https://www.securityweek.com/connectwise-confirms-screenconnect-flaw-under-active-exploitation/
- https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2024-1709
Affected products (1)
- cpe:2.3:a:connectwise:screenconnect:*:*:*:*:*:*:*:*
More vulnerabilities in Connectwise Screenconnect
- CVE-2025-14265 — Critical (CVSS 9.1): In versions of ScreenConnect™ prior to 25.8, server-side validation and integrity checks within the extension…
- CVE-2024-1708 — High (CVSS 8.4): ConnectWise ScreenConnect 23.9.7 and prior are affected by path-traversal vulnerability, which may allow an attacker…
- CVE-2025-3935 — High (CVSS 8.1): ScreenConnect versions 25.2.3 and earlier versions may be susceptible to a ViewState code injection attack. ASP.NET Web…
- CVE-2023-47257 — High (CVSS 8.1): ConnectWise ScreenConnect through 23.8.4 allows man-in-the-middle attackers to achieve remote code execution via…
- CVE-2023-47256 — Medium (CVSS 5.5): ConnectWise ScreenConnect through 23.8.4 allows local users to connect to arbitrary relay servers via implicit trust of…
- CVE-2025-14823 — Medium (CVSS 5.3): In deployments using the ScreenConnect™ Certificate Signing Extension, encrypted configuration values including an…
All CVEs affecting Connectwise Screenconnect →
Other CWE-288 vulnerabilities
- CVE-2026-33591 — Critical (CVSS 10.0): A vulnerability in Wapt Server before version 2.6.1.17813 allows a remote unauthenticated attacker to bypass security…
- CVE-2026-53622 — Critical (CVSS 10.0): Traefik is an HTTP reverse proxy and load balancer. Prior to 3.7.3, there is a critical vulnerability in Traefik's…
- CVE-2026-48491 — Critical (CVSS 10.0): Traefik is an HTTP reverse proxy and load balancer. From 3.7.0 until 3.7.3, there is a high severity vulnerability in…
- CVE-2026-48020 — Critical (CVSS 10.0): Traefik is an HTTP reverse proxy and load balancer. Prior to 2.11.48, 3.6.19, and 3.7.3, there is a high severity…
- CVE-2026-20079 — Critical (CVSS 10.0): A vulnerability in the web interface of Cisco Secure Firewall Management Center (FMC) Software could allow an…
- CVE-2024-10081 — Critical (CVSS 10.0): CodeChecker is an analyzer tooling, defect database and viewer extension for the Clang Static Analyzer and Clang Tidy.…