CVE-2024-1708
high
KEV
CVSS v3
8.4
CVSS v2
—
VIR risk
9.9
Description
ConnectWise ScreenConnect contains a path traversal vulnerability which could allow an attacker to execute remote code or directly impact confidential data and critical systems.
CISA KEV
- Vendor
- ConnectWise
- Product
- ScreenConnect
- Due date
- 2026-05-12
Predictions
Exploit likelihood
99%
Patch ETA
—
Heuristic predictions, AS-IS, for prioritization only.
Mitigations
Vendor advisory: cisa-kev — https://www.connectwise.com/company/trust/security-bulletins/connectwise-screenconnect-23.9.8 ; https://nvd.nist.gov/vuln/detail/CVE-2024-1708
Vendor advisory: 9119a7d8-5eab-497f-8521-727c672e3725 — https://www.connectwise.com/company/trust/security-bulletins/connectwise-screenconnect-23.9.8
Exploits
Application impact
| Vendor | Product | Versions | Fixed |
|---|---|---|---|
| connectwise | screenconnect | {"endExcluding":"23.9.8"} | 23.9.8 |
References
- https://www.connectwise.com/company/trust/security-bulletins/connectwise-screenconnect-23.9.8
- https://www.huntress.com/blog/a-catastrophe-for-control-understanding-the-screenconnect-authentication-bypass
- https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2024-1708
- https://www.microsoft.com/en-us/security/blog/2026/04/06/storm-1175-focuses-gaze-on-vulnerable-web-facing-assets-in-high-tempo-medusa-ransomware-operations/
- https://www.connectwise.com/company/trust/security-bulletins/connectwise-screenconnect-23.9.8 ; https://nvd.nist.gov/vuln/detail/CVE-2024-1708
CWEs
CWE-22
Verify integrity in audit chain (admin only). AS-IS.