ConnectWise · ScreenConnect
CVE-2024-1709
Authentication bypass using an alternate path or channel
O que é
ConnectWise ScreenConnect 23.9.7 and prior are affected by an Authentication Bypass Using an Alternate Path or Channel
vulnerability, which may allow an attacker direct access to confidential information or
critical systems.
CISA: ConnectWise ScreenConnect contains an authentication bypass vulnerability that allows an attacker with network access to the management interface to create a new, administrator-level account on affected devices.
O que fazer
Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.
Prazo para as agências federais dos EUA: 29 de fevereiro de 2024
- Adicionada à lista da CISA
- 22 de fevereiro de 2024
- Publicada
- 21 de fevereiro de 2024
- Gravidade
- Crítica 10,0 CVSS 3.1
- Chance de ataques nos próximos 30 dias (EPSS)
- >99,9% entre os 0,1% mais altos de todas as vulnerabilidades conhecidas
- Fraqueza
- CWE-288
- Mais detalhes
- NVD · CVE.org · CISA
Todas as referências (10)
- https://www.connectwise.com/company/trust/security-bulletins/connectwise-screenconnect-23.9.8
- https://www.huntress.com/blog/vulnerability-reproduced-immediately-patch-screenconnect-23-9-8
- https://www.huntress.com/blog/detection-guidance-for-connectwise-cwe-288-2
- https://www.bleepingcomputer.com/news/security/connectwise-urges-screenconnect-admins-to-patch-critical-rce-f…
- https://github.com/watchtowrlabs/connectwise-screenconnect_auth-bypass-add-user-poc
- https://github.com/rapid7/metasploit-framework/pull/18870
- https://www.horizon3.ai/attack-research/red-team/connectwise-screenconnect-auth-bypass-deep-dive/
- https://techcrunch.com/2024/02/21/researchers-warn-high-risk-connectwise-flaw-under-attack-is-embarrassingly-…
- https://www.securityweek.com/connectwise-confirms-screenconnect-flaw-under-active-exploitation/
- https://www.huntress.com/blog/a-catastrophe-for-control-understanding-the-screenconnect-authentication-bypass
Mais falhas exploradas de ConnectWise
| Adicionado | Vulnerabilidade | Produto | Gravidade | Chance de ataque |
|---|---|---|---|---|
| 11 de set. de 2026 | Improper Privilege Management and Missing Authorization | ScreenConnect | Crítica 9,9 | 0,9% |
| 28 de abr. de 2026 | Path Traversal | ScreenConnect | Alto 8,4 | 95% |
| 2 de jun. de 2025 | Improper Authentication | ScreenConnect | Alto 8,1 | 3,6% |
Fontes: Known Exploited Vulnerabilities (CISA, domínio público), CVE records (cve.org) e EPSS (FIRST). A chance de ataque é a estimativa EPSS de que alguém tente explorar a falha nos próximos 30 dias.