CVE-2024-1709

What it actually does

CVE-2024-1709 is a critical unauthenticated authentication-bypass vulnerability in ConnectWise ScreenConnect 23.9.7 and earlier. The flaw allows a remote attacker to reach privileged setup or administrative functionality through an alternate URL path/channel on an already-deployed instance. Successful exploitation can let the attacker create or obtain administrative access to the ScreenConnect server, after which they can manage remote access sessions, control enrolled agents, execute commands through legitimate ScreenConnect functionality, access sensitive remote-support data, and use the platform as a launch point for broader compromise.

Why it matters to the business

This vulnerability can turn an exposed ScreenConnect server into an attacker-controlled remote-access platform. Because ScreenConnect is commonly trusted for remote administration, compromise can lead to rapid lateral movement, deployment of malware or ransomware, data theft, operational disruption, and loss of trust in remote support infrastructure. It has a CVSS score of 10.0, an EPSS score near 1.0, is listed in CISA KEV, has been used in ransomware activity including Medusa-related campaigns, and the CISA remediation deadline of 2024-02-29 has long passed, so any remaining exposure should be treated as urgent and potentially already compromised.

How an attack unfolds

An attacker scans the internet for exposed ScreenConnect servers and identifies instances running vulnerable versions. They access the vulnerable setup or administrative route using an alternate path that bypasses normal authentication checks. Once the server accepts the unauthenticated request, the attacker creates or gains administrative access. With administrative control, they can add users, change roles, install extensions, view sessions, connect to managed endpoints, issue remote commands, upload tools, disable security controls, harvest data, and deploy additional payloads. In ransomware campaigns, the ScreenConnect server is commonly abused as trusted remote-access infrastructure to stage tooling, move to high-value systems, and deploy encryption or extortion malware.

How to fix it

Upgrade all self-hosted ConnectWise ScreenConnect servers to a fixed release immediately; ConnectWise fixed this issue in ScreenConnect 23.9.8 and later, and organizations should preferentially deploy the latest available supported version rather than stopping at the minimum fixed release. If immediate upgrade is not possible, remove the server from internet exposure, restrict access to trusted VPN or management networks, block public access to setup/admin paths at the reverse proxy or firewall, and disable unnecessary extensions. After patching, assume exposed vulnerable servers may have been compromised: review and remove unauthorized users, reset administrative credentials, rotate API keys and integration secrets, invalidate active sessions, review installed extensions, verify agent inventory, and inspect managed endpoints for follow-on activity. If there is evidence of unauthorized administrator creation or remote command execution, perform incident response rather than treating patching alone as sufficient.

How to confirm the fix worked

Confirm the ScreenConnect server reports version 23.9.8 or later, ideally the latest supported build, from the administrative console or installed application metadata. Verify that no internet-facing instance remains on 23.9.7 or earlier through authenticated asset inventory, vulnerability scanning, external attack-surface scanning, and configuration management records. Test that setup wizard or setup-related paths are not reachable on an already-configured server without authentication. Review reverse proxy and application logs to confirm there are no successful unauthenticated requests to setup wizard routes after remediation. Validate that administrative users, roles, extensions, and integrations match an approved baseline. Confirm that exposed instances have compensating controls such as VPN-only access, IP allowlisting, MFA for administrators, and monitored administrative audit logging.

Typical attack path

1. Identify internet-facing ConnectWise ScreenConnect instances.
2. Determine whether the instance is running ScreenConnect 23.9.7 or earlier, or attempt the known bypass behavior directly.
3. Access the vulnerable setup or administrative path without valid credentials.
4. Create or obtain a privileged ScreenConnect account.
5. Log in through the normal administrative interface using the newly established access.
6. Review connected agents, sessions, users, roles, extensions, and stored configuration.
7. Use ScreenConnect remote-management capabilities to execute commands or transfer files to managed endpoints.
8. Deploy persistence, credential theft tooling, remote access tools, or ransomware payloads.
9. Cover tracks by deleting users, modifying audit history where possible, or blending activity with legitimate remote-support traffic.

How to detect it

Review ScreenConnect application logs, administrative audit logs, reverse proxy logs, firewall logs, EDR telemetry, Windows event logs, and file integrity monitoring data. Look for requests to setup wizard URLs on servers that were already configured, especially requests containing SetupWizard.aspx or trailing-path variants. Correlate those requests with creation of new administrator accounts, role or permission changes, new extensions, unusual logins, new sessions from unfamiliar IP addresses, and remote command or file-transfer activity. Examine ScreenConnect configuration files for unexpected modification times, especially user and security configuration files under the application data directory. On the ScreenConnect server, hunt for suspicious child processes spawned by ScreenConnect services, script interpreters, archive utilities, credential-access tools, or unusual outbound connections. On managed endpoints, investigate activity initiated through ScreenConnect around the time of suspicious administrative changes, including PowerShell, cmd.exe, wmic.exe, rundll32.exe, regsvr32.exe, msiexec.exe, certutil.exe, bitsadmin.exe, and ransomware staging artifacts. Because this vulnerability is in CISA KEV and has been used in ransomware campaigns, absence of a patch should trigger retrospective hunting even if no obvious outage occurred.

• SetupWizard.aspx
• /SetupWizard.aspx
• /SetupWizard.aspx/
• GET /SetupWizard.aspx
• POST /SetupWizard.aspx
• GET /SetupWizard.aspx/
• POST /SetupWizard.aspx/
• C:\Program Files (x86)\ScreenConnect\App_Data\User.xml
• C:\Program Files (x86)\ScreenConnect\App_Data\Logs
• ScreenConnect.Service.exe
• ScreenConnect.ClientService.exe

What your security team should do

• Treat any internet-facing ScreenConnect 23.9.7 or earlier server as a critical incident candidate, not just a routine patching item.
• Upgrade immediately to ScreenConnect 23.9.8 or later, preferably the latest supported release.
• Take vulnerable externally exposed servers offline until they are patched and reviewed.
• Hunt for setup wizard access, unexpected administrator creation, role changes, extension installation, and remote command execution beginning before and after the public disclosure date of 2024-02-21.
• Remove unknown users, revoke sessions, rotate administrator passwords, rotate integration credentials and API keys, and enforce MFA.
• Review connected endpoints for payload execution, new services, suspicious scheduled tasks, credential dumping, and ransomware staging activity.
• Prioritize investigation where ScreenConnect is exposed to the internet, used to manage privileged systems, or has broad endpoint coverage.
• Monitor for Medusa ransomware and other post-exploitation behavior involving remote management tooling, file transfer, PowerShell, command shell activity, and mass encryption indicators.
• Retain ScreenConnect, reverse proxy, firewall, EDR, and Windows event logs for forensic review because exploitation has been active in the wild for an extended period.
• If unauthorized access is confirmed, initiate full incident response including scoping of all managed endpoints reachable through the ScreenConnect instance.