Threat Brief: Connect Wise Screen Connect Vulnerabilities (CVE-2024-1708 and CVE-2024-1709)
Summary: ConnectWise was notified on Feb. 13, 2024, of two vulnerabilities in its ScreenConnect remote desktop software and disclosed them publicly on Feb. 19, 2024; the authentication bypass (CVE-2024-1709) is considered trivially exploitable, with proof-of-concept exploits available and a Metasploit unauthenticated remote code execution module released. As of Feb. 21, 2024, Unit 42 observed 18,188 unique IP addresses hosting ScreenConnect globally, nearly three-quarters of them in the U.S., and CISA added CVE-2024-1709 to its Known Exploited Vulnerabilities Catalog with a federal remediation due date of Feb. 29, 2024.
Why it matters: ConnectWise has confirmed receiving reports of compromised accounts investigated by its incident response team, and Unit 42 assesses with high confidence that cybercriminals and nation-state actors will actively target this trivially exploitable flaw across 18,188 internet-facing hosts.
Read the original at Unit 42 Palo Alto Networks ↗
- Topics
- Threat Actors & Nation-State
- Mentions
- CVE-2024-1708CVE-2024-1709
- Related
- CVE-2024-1708: Connect Wise Screen Connect Path Traversal Vulnerability Known Exploited Vulnerabilities · Apr 28, 2026