{"id":"CVE-2024-1709","kind":"vulnerability","aliases":["CVE-2024-1709"],"related":[],"title":"ConnectWise ScreenConnect 23.9.7 and prior are affected by an Authentication Bypass Using an Alternate Path or…","description":"ConnectWise ScreenConnect contains an authentication bypass vulnerability that allows an attacker with network access to the management interface to create a new, administrator-level account on affected devices.\n\nCISA required action: Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.","summary":"ConnectWise ScreenConnect has an authentication bypass that lets a network attacker create a new administrator account on affected instances. It is listed as actively exploited, including in ransomware campaigns.","severity":"critical","cvss":10.0,"epss":null,"exploited":true,"exploited_at":"2024-02-22T00:00:00+00:00","products":[{"name":"connectwise screenconnect","fixed":["23.9.8"],"affected":"< 23.9.8","ecosystem":"vendor"},{"name":"ConnectWise ScreenConnect","fixed":[],"affected":"","ecosystem":"vendor"}],"ecosystems":["vendor"],"tags":["exploited","ransomware","remote-access","screenconnect","self-hosted","vendor"],"not_affected_if":["managed-hosting"],"how_to_check":null,"fix":"Apply the vendor mitigation or upgrade per ConnectWise guidance; discontinue use if no mitigation is available (CISA required action).","status":"open","published_at":"2024-02-21T16:15:50+00:00","first_seen_at":"2026-10-23T19:11:51+00:00","triaged_at":"2026-10-23T21:02:19+00:00","updated_at":"2026-10-24T00:09:51+00:00","category":"vendor","confidence":0.8,"triage":{"at":"2026-10-23T21:02:19Z","model":"claude-haiku-5-5","output":{"fix":"Apply the vendor mitigation or upgrade per ConnectWise guidance; discontinue use if no mitigation is available (CISA required action).","reach":"network","impact":"high","summary":"ConnectWise ScreenConnect has an authentication bypass that lets a network attacker create a new administrator account on affected instances. It is listed as actively exploited, including in ransomware campaigns.","category":"vendor","who_cares":["screenconnect","self-hosted","remote-access"],"confidence":0.8,"needs_auth":"no","worst_case":"Attacker creates admin account and takes full control of the ScreenConnect server","analyst_note":"Find affected and fixed version numbers and the vendor advisory in the ConnectWise security bulletin for CVE-2024-1709 to fill how_to_check and fix.","how_to_check":"unknown","needs_analyst":true,"not_affected_if":["managed-hosting"],"user_interaction":"no","needs_special_setup":"unknown","severity_if_unknown":"critical"},"cost_usd":0.000461,"input_tokens":2838,"output_tokens":355,"severity_before":"unknown"},"analyst_status":null,"analyst_note":null,"search":"'-1709':18A,21A '-2024':17A,20A '23.9.7':3A 'access':30B,78C 'account':51B,90C 'action':96C 'activ':59B 'administr':50B,88C 'administrator-level':87C 'affect':7A,53B,92C 'allow':73C 'altern':14A 'appli':97C 'attack':46B,75C 'authent':10A,40B,69C 'bypass':11A,41B,70C 'campaign':64B 'cisa':94C 'connectwis':1A,36B,65C 'connectwise':22A,24A 'contain':67C 'creat':47B,84C 'cve':16A,19A 'devic':93C 'discontinu':103C 'exploit':26B,60B 'host':34B 'includ':61B 'instanc':54B 'instruct':101C 'interfac':82C 'let':43B 'level':89C 'list':57B 'manag':81C 'mitig':98C,109C 'network':45B,77C 'new':49B,86C 'path':15A 'per':99C 'prior':5A 'product':107C 'ransomwar':27B,63B 'remot':29B 'remote-access':28B 'requir':95C 'screenconnect':2A,23A,25A,31B,37B,66C 'self':33B 'self-host':32B 'unavail':111C 'use':12A,104C 'vendor':35B,100C 'vulner':71C","nicknames":[],"mitigations":[],"who_affected":null,"tier":null,"verified":{},"analyst_revisit_at":null,"first_public_at":"2024-02-21T16:15:50+00:00","kev":{"dateAdded":"2024-02-22","dueDate":"2024-02-29","requiredAction":"Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.","knownRansomwareCampaignUse":"Known"},"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H","cvss_by":"9119a7d8-5eab-497f-8521-727c672e3725","poc_count":0,"sources":[{"source":"kev","external_id":"CVE-2024-1709","url":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2024-1709","severity":null,"published_at":"2024-02-22T00:00:00+00:00","modified_at":null,"first_seen_at":"2026-10-23T19:11:51+00:00","fetched_at":"2026-10-25T20:35:34+00:00","note":null},{"source":"nvd","external_id":"CVE-2024-1709","url":"https://nvd.nist.gov/vuln/detail/CVE-2024-1709","severity":null,"published_at":"2024-02-21T16:15:50+00:00","modified_at":"2026-06-17T07:04:50+00:00","first_seen_at":"2026-10-23T22:29:05+00:00","fetched_at":"2026-10-23T22:29:05+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}