---
title: "ScreenConnect Auth Bypass CVE-2024-1709 (CVSS 10)"
url: https://erroneo.us/security/briefs/connectwise-screenconnect-auth-bypass-cve-2024-1709/
description: "On-prem ConnectWise ScreenConnect 23.9.7 and earlier: one-request admin takeover, exploited by ransomware crews. Fixed in 23.9.8. Unpatched servers: act now."
type: security-brief
section: "Security Digest"
date_published: 2024-02-19
date_modified: 2026-10-21
publisher: erroneo.us
author: erroneo.us Security Desk
verdict: "Act now"
cves: ["CVE-2024-1709", "CVE-2024-1708"]
severity: "critical"
exploited: "in-the-wild"
kev: true
license: All rights reserved. Quote with attribution and a link.
---

# ScreenConnect Auth Bypass CVE-2024-1709 (CVSS 10)

**Verdict: Act now.** Any on-premises ScreenConnect server still below 23.9.8 should be treated as compromised until proven otherwise; cloud-hosted customers were patched by ConnectWise.

- **Who must act:** Anyone running a self-hosted ScreenConnect server on version 23.9.7 or earlier, especially if it is reachable from the internet.
- **Who can relax:** ConnectWise cloud-hosted customers and anyone already on 23.9.8 or later who has checked for signs of compromise.
- **Affected:** ConnectWise ScreenConnect (on-premises) 23.9.7 and prior
- **Fixed:** ScreenConnect 23.9.8 and later; ScreenConnect 22.4.20001 (interim build for partners not on active maintenance)
- **CVEs:** CVE-2024-1709, CVE-2024-1708
- **CISA KEV:** yes · **Exploitation:** Exploited in the wild

## What to do

1. Check the ScreenConnect server version and upgrade on-premises servers to 23.9.8 or later (or 22.4.20001 if off maintenance).
2. Before returning a server to service, check IIS logs, the user list and App_Extensions for signs of compromise.
3. Remove unrecognized accounts, reset all ScreenConnect passwords and enable MFA.
4. Re-validate and re-add any extensions you rely on after upgrading.
5. If you find evidence of compromise, rebuild the server and investigate every endpoint it manages.

### How to check if you are affected

- Search IIS logs for requests to SetupWizard.aspx followed by an extra path segment (for example /SetupWizard.aspx/anything); Huntress says this is never legitimate.
- Look for .aspx or .ashx files in the root of C:\Program Files (x86)\ScreenConnect\App_Extensions\.
- Review the ScreenConnect user list for unknown administrator accounts or missing legitimate users (the exploit replaces the user database).
- Check logs and firewall data for the IOC addresses ConnectWise published: 155.133.5.15, 155.133.5.14 and 118.69.65.60.

## What happened

On February 19, 2024, ConnectWise published a [critical security bulletin](https://www.connectwise.com/company/trust/security-bulletins/connectwise-screenconnect-23.9.8) for ScreenConnect, its remote-access product, covering two flaws reported to it on February 13. The first, CVE-2024-1709, is an authentication bypass (CWE-288) rated [CVSS 3.1 10.0 by NVD](https://nvd.nist.gov/vuln/detail/CVE-2024-1709). The second, CVE-2024-1708, is a path traversal rated [8.4](https://www.cve.org/CVERecord?id=CVE-2024-1708) that requires administrator access.

The bug is simple to exploit. [Huntress's analysis](https://www.huntress.com/blog/a-catastrophe-for-control-understanding-the-screenconnect-authentication-bypass) found that the check meant to lock the setup wizard after installation compared the request path to exactly `/SetupWizard.aspx`. Adding any trailing segment, such as `/SetupWizard.aspx/anything`, skipped the check and reopened the wizard on a configured server. An attacker could then create a new administrator, which overwrites the user database and deletes the existing local users. From there, uploading a malicious extension runs .NET code as SYSTEM. CVE-2024-1708 (a ZipSlip-style bug in extension handling) lets extension files be written outside their own folder.

ConnectWise said it had no evidence of exploitation when it published, but it posted attacker IP addresses the next day. CISA [added CVE-2024-1709 to its Known Exploited Vulnerabilities catalog](https://www.cisa.gov/news-events/alerts/2024/02/22/cisa-adds-one-known-exploited-vulnerability-catalog) on February 22, 2024. The [KEV catalog](https://www.cisa.gov/known-exploited-vulnerabilities-catalog) marks it as known to be used in ransomware campaigns. As of October 21, 2026, the catalog also lists CVE-2024-1708, added April 28, 2026, with known ransomware use.

## Who is affected

Only **self-hosted (on-premises) ScreenConnect servers on 23.9.7 and earlier** are affected. ConnectWise says it mitigated cloud instances within 48 hours of validating the report, and it confirmed on February 27 that cloud partners needed to take no action. The bulletin says agents installed on endpoints are not directly affected. However, every machine a compromised server manages is exposed, because an attacker with admin access can push commands and tools to them.

## Do you really need to act?

If you run an on-premises server below 23.9.8, yes, today. The attack needs no credentials and no user interaction, takes one crafted request, and was used by criminal groups within days. ScreenConnect is often internet-facing by design, and MSPs use it to reach many customer networks, which makes it an attractive target.

ConnectWise took the unusual step of suspending unpatched on-premises instances that checked in, and of offering an interim 22.4.20001 build at no cost to partners without active maintenance. That reduced the number of exposed servers, but it was not a guarantee. A server that was exposed while unpatched in February 2024 may have been compromised before it was upgraded, and upgrading does not remove an attacker's accounts or web shells.

Cloud customers and patched servers that pass the checks below can relax.

## What to do now

1. Check the server version. Upgrade to 23.9.8 or later. If you are off maintenance, use 22.4.20001 and follow the stepped upgrade path in the [bulletin](https://www.connectwise.com/company/trust/security-bulletins/connectwise-screenconnect-23.9.8).
2. Before bringing the server back online, check Windows event logs, EDR data and the file system for web shells or other signs of compromise, as ConnectWise advises.
3. After patching, remove unrecognized users, change passwords, enable MFA, and re-validate any extensions.
4. If you see license errors during the upgrade, follow the bulletin's steps to move `License.xml` out of `App_Data` temporarily.
5. If compromised, rebuild the server and investigate the endpoints it controls.

## How to tell if you were hit

- Search IIS logs for requests to `SetupWizard.aspx` with a trailing path segment. Huntress says this pattern is never legitimate and publishes Sigma and YARA rules for it.
- Any `.aspx` or `.ashx` file in the root of `C:\Program Files (x86)\ScreenConnect\App_Extensions\` is likely malicious.
- Unknown admin accounts, or legitimate users who suddenly disappeared, point to the user database having been overwritten.
- Look for traffic to or from the IOC addresses ConnectWise listed on February 20, 2024: 155.133.5.15, 155.133.5.14 and 118.69.65.60.

## Timeline

- Feb 13, 2024 — Vulnerabilities reported to ConnectWise.
- Feb 19, 2024 — ScreenConnect 23.9.8 released and bulletin published.
- Feb 20, 2024 — ConnectWise publishes IOCs.
- Feb 21, 2024 — CVE records published, and Huntress publishes its technical analysis.
- Feb 22, 2024 — CISA adds CVE-2024-1709 to KEV. ConnectWise announces the suspension of unpatched instances.
- Feb 23, 2024 — Interim 22.4 build offered to partners not on maintenance.
- Apr 28, 2026 — CISA adds CVE-2024-1708 to KEV.

## Sources

1. [ConnectWise — ScreenConnect 23.9.8 Security Bulletin](https://www.connectwise.com/company/trust/security-bulletins/connectwise-screenconnect-23.9.8)
2. [NVD — CVE-2024-1709](https://nvd.nist.gov/vuln/detail/CVE-2024-1709)
3. [CVE.org — CVE-2024-1708](https://www.cve.org/CVERecord?id=CVE-2024-1708)
4. [CISA — CISA Adds One Known Exploited Vulnerability to Catalog (Feb 22, 2024)](https://www.cisa.gov/news-events/alerts/2024/02/22/cisa-adds-one-known-exploited-vulnerability-catalog)
5. [CISA — Known Exploited Vulnerabilities Catalog](https://www.cisa.gov/known-exploited-vulnerabilities-catalog)
6. [Huntress — A Catastrophe For Control: Understanding the ScreenConnect Authentication Bypass](https://www.huntress.com/blog/a-catastrophe-for-control-understanding-the-screenconnect-authentication-bypass)

---
Source page: https://erroneo.us/security/briefs/connectwise-screenconnect-auth-bypass-cve-2024-1709/ · Security Digest: https://erroneo.us/security/ · More: https://erroneo.us/llms.txt