CVE-2024-1708

What it actually does

CVE-2024-1708 is a path traversal vulnerability in ConnectWise ScreenConnect 23.9.7 and earlier. A user with sufficient privileges and the required interaction path may be able to cause the application to read from or write to unintended filesystem locations outside the expected ScreenConnect application directory. Depending on the reachable file operation and service permissions, this can expose sensitive configuration or data, overwrite application-controlled files, place malicious files in executable locations, or contribute to remote code execution. Because ScreenConnect is a remote administration platform, successful exploitation can have outsized impact: compromise of the server can become a route to interactive access across systems managed through the product.

Why it matters to the business

A compromised ScreenConnect server can give an attacker a powerful foothold into remote support operations and the endpoints managed through that platform. The vulnerability is listed in CISA KEV, has a high EPSS score, is reported as actively exploited in the wild, and is associated with ransomware activity, so internet-facing or unpatched instances should be treated as urgent exposure even though the issue was published in 2024. Operational consequences can include theft of support-system data, unauthorized remote access, deployment of malware through legitimate remote management channels, service disruption, and ransomware propagation.

How an attack unfolds

An attacker first identifies an exposed ScreenConnect instance and determines whether it is running 23.9.7 or an earlier vulnerable build. If the attacker has or obtains the required application privileges, they interact with a vulnerable file-handling workflow and supply traversal sequences such as ../ or encoded equivalents to escape the intended directory. The attacker then attempts to read sensitive files, write attacker-controlled content to locations processed by the application, or place files where the ScreenConnect service or web application will later load or execute them. In real-world incidents involving ScreenConnect, exploitation has often been paired with other access paths or post-authentication control of the server, followed by creation of unauthorized accounts, deployment of remote-control tooling, credential theft, and ransomware staging.

How to fix it

Upgrade ConnectWise ScreenConnect to a fixed release immediately; ConnectWise addressed this issue in 23.9.8 and later, and organizations should run the latest supported ScreenConnect version rather than 23.9.7 or earlier. If immediate upgrade is not possible, remove public internet exposure, restrict access to trusted VPN or administrative networks, enforce multifactor authentication, review all ScreenConnect administrator and technician accounts, disable unnecessary extensions, and monitor or block suspicious traversal patterns at the reverse proxy or WAF. Because this vulnerability is in CISA KEV and associated with ransomware campaigns, patching should be paired with compromise assessment rather than treated as a routine update.

How to confirm the fix worked

Confirm the ScreenConnect server reports version 23.9.8 or later, preferably the latest supported vendor release. Verify that no public endpoints expose an older ScreenConnect build through headers, login pages, static assets, or administrative UI version information. Review vendor update logs and service restart history to ensure the patched application binaries are active. If a WAF or reverse proxy mitigation is used, test that requests containing ../, ..\, %2e%2e%2f, and double-encoded traversal variants are blocked or logged. Validate that application directories, extension directories, configuration files, and web-root locations do not contain unexpected recently modified files.

Typical attack path

1. Scan the internet or target ranges for exposed ConnectWise ScreenConnect servers.
2. Fingerprint the application version and identify systems running 23.9.7 or earlier.
3. Obtain or abuse the privileges needed to reach the vulnerable file-handling functionality.
4. Submit path traversal payloads using ../, ..\, or URL-encoded variants to access files outside the intended directory.
5. Read sensitive configuration or data, or write attacker-controlled files into application-relevant locations.
6. Use the compromised ScreenConnect server to establish persistence, create or abuse administrative access, and reach managed endpoints.
7. Deploy payloads such as remote-access tools, credential stealers, web shells, or ransomware through the compromised management platform.

How to detect it

Look for evidence of both attempted traversal and post-exploitation activity. Review ScreenConnect web/application logs, reverse proxy logs, WAF logs, Windows Event Logs, IIS logs if present, EDR telemetry, file integrity monitoring, and ScreenConnect administrative audit data. Search HTTP request paths, query strings, form fields, and referrers for traversal sequences such as ../, ..\, URL-encoded %2e%2e, and double-encoded traversal payloads. Examine ScreenConnect application directories for unexpected recently created or modified files, especially under web-root, App_Data, App_Extensions, toolbox, or extension-related paths. Review account changes for newly created users, newly elevated administrators, suspicious technician accounts, or disabled security controls. Investigate unusual child processes spawned by the ScreenConnect service or web worker process, including command shells, scripting engines, download utilities, archive tools, and ransomware-related tooling. Correlate suspicious ScreenConnect activity with outbound connections to unfamiliar infrastructure and new remote sessions to multiple managed endpoints in a short period.

• ../
• ..\
• %2e%2e%2f
• %2e%2e%5c
• %252e%252e%252f
• %252e%252e%255c
• C:\Program Files (x86)\ScreenConnect\App_Data\User.xml
• C:\Program Files (x86)\ScreenConnect\App_Extensions\
• C:\Program Files (x86)\ScreenConnect\App_Data\
• C:\Program Files (x86)\ScreenConnect\Bin\
• ScreenConnect.Service.exe
• ScreenConnect.ClientService.exe
• cmd.exe /c
• powershell.exe -enc
• powershell.exe -EncodedCommand
• certutil.exe -urlcache
• bitsadmin /transfer
• rundll32.exe
• regsvr32.exe
• mshta.exe

What your security team should do

• Immediately inventory all ConnectWise ScreenConnect instances, including self-hosted, cloud-managed, test, and legacy deployments.
• Prioritize patching to 23.9.8 or later, preferably the latest supported release, for any instance running 23.9.7 or earlier.
• Treat internet-facing vulnerable instances as potentially compromised and begin incident-response triage before or during remediation.
• Review ScreenConnect users, roles, sessions, extensions, toolbox items, and recent administrative actions for unauthorized changes.
• Hunt for traversal strings, suspicious file writes, unexpected extensions, web shells, new administrator accounts, and unusual remote-control sessions.
• Restrict ScreenConnect administrative access to trusted networks and require MFA for all privileged accounts.
• Rotate credentials and secrets that may have been stored on or accessible from the ScreenConnect server if compromise is suspected.
• Because this is KEV-listed and associated with ransomware activity, escalate remediation and hunting to emergency priority and track completion against the CISA due date of 2026-05-12 where applicable.