CVE-2024-1709 ConnectWise ScreenConnect Authentication Bypass
Attackers can bypass authentication to access confidential information and critical systems in ConnectWise ScreenConnect.
- Exploited in the wild
- Since 22 Feb 2024
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2024-1709?
CVE-2024-1709 is a critical authentication bypass vulnerability in ConnectWise ScreenConnect, published on 21 Feb 2024. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
ConnectWise ScreenConnect 23.9.7 and prior are affected by an Authentication Bypass Using an Alternate Path or Channel
vulnerability, which may allow an attacker direct access to confidential information or
critical systems.
Weakness: CWE-288
Which versions are affected by CVE-2024-1709?
It affects 1 product.
Products include Connectwise Screenconnect.
How do I fix CVE-2024-1709?
No fix has been published for CVE-2024-1709 yet. Limit exposure of the affected software until one is available. US federal agencies must fix it by 29 Feb 2024.
Upgrade, and rotate credentials and sessions that may have been exposed. More about Authentication bypass.
Is CVE-2024-1709 being exploited?
Yes. Attackers have exploited CVE-2024-1709 in the wild since at least 22 Feb 2024, including in ransomware campaigns.
Public exploit code: 1 Metasploit module, 1 Nuclei template and 5 proofs of concept on GitHub.
Other vulnerabilities in ConnectWise ScreenConnect
- CVE-2026-84869 ConnectWise ScreenConnect Improper Privilege Management and Missing Authorization
- CVE-2024-1708 ConnectWise ScreenConnect Path Traversal
- CVE-2025-3935 ConnectWise ScreenConnect Improper Authentication
- CVE-2025-14265 Improper server-side validation in ScreenConnect extension framework
- CVE-2025-14823 Certificate Signing Extension Returns Encrypted Values
Sources
Also known as CVE-2024-27215, GHSA-cg3j-75xh-7fv3.