CVE-2024-1709: ConnectWise ScreenConnect Authentication Bypass Vulnerability

CVE-2024-1709 is an authentication bypass vulnerability in ConnectWise ScreenConnect. An attacker who can reach the management interface over the network can create a new administrator-level account on affected systems. This matters because the product is commonly used for remote support and management; successful abuse can give an attacker full administrative control of the ScreenConnect instance and the systems it manages. The vulnerability has been used by ransomware operators, so rapid identification and remediation are essential.

Public technical detail beyond the CISA summary is limited; always confirm exact affected builds, fixed versions, and any additional guidance against the official ConnectWise advisory.

How it works

The flaw is classified as CWE-288 (Authentication Bypass Using an Alternate Path or Channel). In essence, the authentication checks that should prevent unauthenticated users from performing privileged actions can be circumvented. With network access to the management interface, an attacker can create a new administrator account without valid credentials. Once that account exists, the attacker can log in with full administrative rights, install additional software, pivot to managed endpoints, or deploy ransomware. Exact request paths or parameters are not provided here; treat any unauthenticated interaction that results in new admin accounts as a high-severity indicator and validate behavior against the vendor advisory.

Am I affected? How to find it in your systems

ConnectWise ScreenConnect is typically deployed as an on-premises remote-support and remote-access server, often exposed to the internet or to partner networks so technicians can connect to client machines. Inventory every instance by searching asset databases, configuration-management tools, and network scans for hosts running ScreenConnect services or listening on the ports the product uses for its web management interface.

• Identify all ScreenConnect servers and note their software versions; compare those versions to the fixed releases listed in the ConnectWise advisory.
• Review administrative account lists for any recently created or unexpected administrator accounts.
• Examine web-server and application logs for unauthenticated requests that result in account-creation activity or for successful logins by accounts that should not exist.
• Check network telemetry for unusual inbound connections to the management interface from unexpected sources, especially shortly before ransomware activity or lateral movement.

If you cannot determine the exact version, assume the instance is vulnerable until proven otherwise by the vendor’s guidance.

How to remediate

Patch first. Apply the vendor-supplied update that addresses CVE-2024-1709 as soon as it can be tested and deployed. Follow the exact upgrade steps and any post-update verification steps published by ConnectWise. CISA’s required action is to apply mitigations per vendor instructions or to discontinue use of the product if mitigations are unavailable.

• After patching, force a password reset or re-validation of all administrator accounts and remove any accounts that cannot be accounted for.
• Confirm that the management interface is no longer reachable by unauthenticated clients.
• Harden remaining instances by restricting management-interface access to trusted networks or jump hosts, enabling multi-factor authentication where supported, and ensuring detailed audit logging is enabled.

If you can't patch immediately

Until the vendor update can be applied, reduce exposure with compensating controls:

• Segment the ScreenConnect server so that the management interface is reachable only from a tightly controlled administrative network or VPN; block direct internet access if it is not required.
• Place a web application firewall or reverse-proxy rule in front of the interface to block unauthenticated account-creation requests if the vendor or a trusted security provider has published signatures for this class of bypass.
• Temporarily disable or restrict the features that allow new account creation if the product configuration permits it without breaking critical support workflows.
• Increase monitoring: alert on any new administrator account creation, failed or successful logins from unexpected sources, and any subsequent remote-control sessions initiated by newly created accounts.
• If the risk cannot be acceptably reduced, take the instance offline and switch to an alternative remote-support method until a patched version is available.

If your data may have been exposed

Because this vulnerability is known to be exploited by ransomware groups, any unpatched ScreenConnect instance that was reachable from untrusted networks should be treated as potentially compromised. Investigate for unauthorized administrator accounts, unexpected remote sessions, and indicators of ransomware staging or encryption. Rotate credentials for any accounts that could have been accessed through the ScreenConnect server, and review systems that were managed by it for further compromise. You can also run a free exposure scan of your email addresses against known breach data sets to determine whether related credentials have already appeared in public dumps.