erroneo.us
Search all guides⌘K

Security Digest · Feb 19, 2024 · Vulnerability · Network edge

ScreenConnect Auth Bypass CVE-2024-1709 (CVSS 10)

On-prem ConnectWise ScreenConnect 23.9.7 and earlier: one-request admin takeover, exploited by ransomware crews. Fixed in 23.9.8. Unpatched servers: act now.

Published By erroneo.us Security Desk · Updated 3 min read6 sources

Our verdict

Act now

Any on-premises ScreenConnect server still below 23.9.8 should be treated as compromised until proven otherwise; cloud-hosted customers were patched by ConnectWise.

Who must act: Anyone running a self-hosted ScreenConnect server on version 23.9.7 or earlier, especially if it is reachable from the internet.

Who can relax: ConnectWise cloud-hosted customers and anyone already on 23.9.8 or later who has checked for signs of compromise.

Affected
ConnectWise ScreenConnect (on-premises) 23.9.7 and prior
Fixed in
ScreenConnect 23.9.8 and later
ScreenConnect 22.4.20001 (interim build for partners not on active maintenance)
CVSS
10.0 (v3.1, NVD)
EPSS
100.0% (percentile 100.0)
CISA KEV
Yes, listed as known exploited
Exploitation
Exploited in the wild
Severity
Critical

What to do

  1. Check the ScreenConnect server version and upgrade on-premises servers to 23.9.8 or later (or 22.4.20001 if off maintenance).
  2. Before returning a server to service, check IIS logs, the user list and App_Extensions for signs of compromise.
  3. Remove unrecognized accounts, reset all ScreenConnect passwords and enable MFA.
  4. Re-validate and re-add any extensions you rely on after upgrading.
  5. If you find evidence of compromise, rebuild the server and investigate every endpoint it manages.

How to check if you are affected or compromised

  • Search IIS logs for requests to SetupWizard.aspx followed by an extra path segment (for example /SetupWizard.aspx/anything); Huntress says this is never legitimate.
  • Look for .aspx or .ashx files in the root of C:\Program Files (x86)\ScreenConnect\App_Extensions\.
  • Review the ScreenConnect user list for unknown administrator accounts or missing legitimate users (the exploit replaces the user database).
  • Check logs and firewall data for the IOC addresses ConnectWise published: 155.133.5.15, 155.133.5.14 and 118.69.65.60.

What happened#

On February 19, 2024, ConnectWise published a critical security bulletin for ScreenConnect, its remote-access product, covering two flaws reported to it on February 13. The first, CVE-2024-1709, is an authentication bypass (CWE-288) rated CVSS 3.1 10.0 by NVD. The second, CVE-2024-1708, is a path traversal rated 8.4 that requires administrator access.

The bug is simple to exploit. Huntress's analysis found that the check meant to lock the setup wizard after installation compared the request path to exactly /SetupWizard.aspx. Adding any trailing segment, such as /SetupWizard.aspx/anything, skipped the check and reopened the wizard on a configured server. An attacker could then create a new administrator, which overwrites the user database and deletes the existing local users. From there, uploading a malicious extension runs .NET code as SYSTEM. CVE-2024-1708 (a ZipSlip-style bug in extension handling) lets extension files be written outside their own folder.

ConnectWise said it had no evidence of exploitation when it published, but it posted attacker IP addresses the next day. CISA added CVE-2024-1709 to its Known Exploited Vulnerabilities catalog on February 22, 2024. The KEV catalog marks it as known to be used in ransomware campaigns. As of October 21, 2026, the catalog also lists CVE-2024-1708, added April 28, 2026, with known ransomware use.

Who is affected#

Only self-hosted (on-premises) ScreenConnect servers on 23.9.7 and earlier are affected. ConnectWise says it mitigated cloud instances within 48 hours of validating the report, and it confirmed on February 27 that cloud partners needed to take no action. The bulletin says agents installed on endpoints are not directly affected. However, every machine a compromised server manages is exposed, because an attacker with admin access can push commands and tools to them.

Do you really need to act?#

If you run an on-premises server below 23.9.8, yes, today. The attack needs no credentials and no user interaction, takes one crafted request, and was used by criminal groups within days. ScreenConnect is often internet-facing by design, and MSPs use it to reach many customer networks, which makes it an attractive target.

ConnectWise took the unusual step of suspending unpatched on-premises instances that checked in, and of offering an interim 22.4.20001 build at no cost to partners without active maintenance. That reduced the number of exposed servers, but it was not a guarantee. A server that was exposed while unpatched in February 2024 may have been compromised before it was upgraded, and upgrading does not remove an attacker's accounts or web shells.

Cloud customers and patched servers that pass the checks below can relax.

What to do now#

  1. Check the server version. Upgrade to 23.9.8 or later. If you are off maintenance, use 22.4.20001 and follow the stepped upgrade path in the bulletin.
  2. Before bringing the server back online, check Windows event logs, EDR data and the file system for web shells or other signs of compromise, as ConnectWise advises.
  3. After patching, remove unrecognized users, change passwords, enable MFA, and re-validate any extensions.
  4. If you see license errors during the upgrade, follow the bulletin's steps to move License.xml out of App_Data temporarily.
  5. If compromised, rebuild the server and investigate the endpoints it controls.

How to tell if you were hit#

  • Search IIS logs for requests to SetupWizard.aspx with a trailing path segment. Huntress says this pattern is never legitimate and publishes Sigma and YARA rules for it.
  • Any .aspx or .ashx file in the root of C:\Program Files (x86)\ScreenConnect\App_Extensions\ is likely malicious.
  • Unknown admin accounts, or legitimate users who suddenly disappeared, point to the user database having been overwritten.
  • Look for traffic to or from the IOC addresses ConnectWise listed on February 20, 2024: 155.133.5.15, 155.133.5.14 and 118.69.65.60.

Timeline#

  • — Vulnerabilities reported to ConnectWise.
  • — ScreenConnect 23.9.8 released and bulletin published.
  • — ConnectWise publishes IOCs.
  • — CVE records published, and Huntress publishes its technical analysis.
  • — CISA adds CVE-2024-1709 to KEV. ConnectWise announces the suspension of unpatched instances.
  • — Interim 22.4 build offered to partners not on maintenance.
  • — CISA adds CVE-2024-1708 to KEV.

Vulnerability records

  • CVE-2024-1709 · KEV 2024-02-22 · ConnectWise ScreenConnect 23.9.7 and prior are affected by an Authentication Bypass Using an Alternate Path or Channel vulnerability, which may allow an…
  • CVE-2024-1708 · KEV 2026-04-28 · ConnectWise ScreenConnect 23.9.7 and prior are affected by path-traversal vulnerability, which may allow an attacker the ability to execute remote code or…

Sources

Original sources first: vendor and project advisories, CVE and government records, the discoverers’ write-ups. Every claim above links to one of these. See how the Security Desk works.

Original and primary sources

  1. ConnectWise — ScreenConnect 23.9.8 Security Bulletin connectwise.com
  2. NVD — CVE-2024-1709 nvd.nist.gov
  3. CVE.org — CVE-2024-1708 cve.org
  4. CISA — CISA Adds One Known Exploited Vulnerability to Catalog (Feb 22, 2024) cisa.gov
  5. CISA — Known Exploited Vulnerabilities Catalog cisa.gov
  6. Huntress — A Catastrophe For Control: Understanding the ScreenConnect Authentication Bypass huntress.com