ConnectWise ScreenConnect Vulnerabilities (CVE-2024-1709 and CVE-2024-1708)

Bar Refael

February 26, 2024

Sophos X-Ops has identified a concerning trend in the exploitation of critical vulnerabilities within ConnectWise ScreenConnect, a widely utilized remote monitoring and management software. Two vulnerabilities, CVE-2024-1709 and CVE-2024-1708, have been disclosed, posing significant risks to organizations using older versions of ScreenConnect. Immediate action is required to mitigate the threat of remote code execution and data breaches.

Vulnerability Details:

  • CVE-2024-1709: Authentication bypass with a CVSS score of 10 (Critical).
  • CVE-2024-1708: Path traversal with a CVSS score of 8.4 (High).

Threat Landscape:

Active exploitation of these vulnerabilities has been observed, leading to the deployment of various malware strains, including LockBit ransomware and AsyncRAT. The severity of these attacks highlights the urgent need for organizations to patch their installations and enhance their network defenses.

Recommendations:

  • Patch Immediately: Upgrade to ScreenConnect version 23.9.8 or later to address the vulnerabilities.
  • Proactive Threat Hunting: Conduct thorough reviews of system logs and network traffic for signs of compromise.
  • Enhance Network Defenses: Implement additional security measures such as firewalls, intrusion detection systems, and regular vulnerability scanning.

Conclusion:

The discovery of CVE-2024-1709 and CVE-2024-1708 underscores the importance of maintaining up-to-date software and vigilant cybersecurity practices. Organizations using ConnectWise ScreenConnect must take immediate action to protect their systems and data from potential exploitation.

Stay Secure. Stay Informed.

OP Innovate Research Team.

Under Cyber Attack?

Fill out the form and we will contact you immediately.

Under Cyber Attack?

Fill out the form and we will contact you immediately.