ConnectWise ScreenConnect 23.9.7 and prior are affected by an Authentication Bypass Using an Alternate Path or Channel vulnerability, which may allow an attacker direct access to confidential information or critical systems.

Reports indicate that Kimsuky, a North Korean APT group, has been exploiting both ScreenConnect flaws to infect victims with the ToddlerShark malware. 

Both ScreenConnect vulnerabilities have been exploited by ransomware groups including Black Basta annd the Bl00dy Ransomware Gang. Patch these flaws as soon as possible.

With continued exploitation of CVE-2024-1709, also known as 'SlashAndGrab,' organizations should apply the available patches as soon as possible.

Confirmed ransomware attacks linked to exploitation of CVE-2024-1709 underscore how serious these ScreenConnect flaws are and how important it is to patch them.

Public exploit code and in the wild exploitation have already been discovered, immediate patching is recommended

The ConnectWise ScreenConnect Service running on the remote host is affected by an authentication bypass vulnerability. An unauthenticated, remote attacker can exploit this, via a crafted message, to bypass authentication to gain admin access on the system.

According to its version, the ConnectWise ScreenConnect Service remote access software installed on the remote Windows host is prior to 23.9.8. It is, therefore affected by multiple vulnerabilities:

  - A path-traversal vulnerability which may allow an attacker the ability to execute remote code or directly impact     confidential data or critical systems. (CVE-2024-1708)

  - An Authentication Bypass Using an Alternate Path or Channel vulnerability which may allow an attacker direct     access to confidential information or critical systems. (CVE-2024-1709)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

ConnectWise ScreenConnect versions before 23.9.8 suffer from an authentication bypass vulnerability. By leveraging this vulnerability, a remote and unauthenticated user can create a new user account and gain access to the vulnerable instance.

ID	Name	Product	Family	Severity
190893	ConnectWise ScreenConnect Service < 23.9.8 Authentication Bypass (Direct Check)	Nessus	CGI abuses	critical
190886	ConnectWise ScreenConnect Service < 23.9.8 Multiple Vulnerabilities	Nessus	Windows	critical
114214	ConnectWise ScreenConnect < 23.9.8 Authentication Bypass	Web App Scanning	Component Vulnerability	critical

Detections

Analytics

CVE-2024-1709

critical

Tenable Plugins

critical

critical

critical