CVE-2024-1708 — ConnectWise ScreenConnect: Path Traversal | CVSS 8.4 HIGH

HIGH

CVSS 8.4 HIGH  ·  EPSS 85%  ·  ConnectWise ScreenConnect

Severity Overview

Summary

ConnectWise ScreenConnect 23.9.7 and prior are affected by path-traversal vulnerability, which may allow an attacker

the ability to execute remote code or directly impact confidential data or critical systems.

What the Attack Looks Like

How it works: An attacker sends a request containing directory traversal sequences (e.g., ../) that force the application to access files outside its intended directory, potentially exposing credentials, configuration files, or enabling arbitrary file write.

If successfully exploited: Because this vulnerability has a scope change, the impact extends beyond the vulnerable component — adjacent services or system resources may be compromised as well. Full confidentiality and integrity impact means an attacker can both read and modify sensitive data — useful for credential harvesting, data theft, or manipulating application state. High availability impact means the vulnerability can also cause a denial of service, which may be used for disruption or as a diversion during a broader attack.

Analyst Takeaway

The attack is launched over the network (remotely exploitable without physical access); a user must be tricked into taking an action such as opening a file or clicking a link, and high-privileged (administrative) credentials are required — the attacker must already control an admin account. A successful exploit can break out of the vulnerable component and affect other system resources (scope change), potentially enabling broader compromise. This vulnerability is already in CISA KEV, which means exploitation has been confirmed in the wild — treat this as active risk, not theoretical exposure. The CVSS score is high enough to justify expedited remediation, especially for exposed systems or assets that handle sensitive data. In parallel with patching, defenders should review external exposure, hunt for signs of exploitation, and validate whether compensating controls are in place for vulnerable assets.

Detection Guidance

• CWE-22 — Path Traversal
  • Web server access logs: Search request URIs and parameters for traversal sequences: ../, ..%2F, ..%5C, %2e%2e%2f, %252e%252e (double-encoded), and Windows-style ..\. A WAF or web application log with URI decoding enabled will surface these most reliably.
  • Sensitive file access patterns: Look for requests that reference known sensitive paths: /etc/passwd, /etc/shadow, web.config, .env, .git/config, wp-config.php, or Windows SAM/SYSTEM hives.
  • File system monitoring: If the application process accesses files outside its designated working directory — especially system files or credential stores — flag those access events regardless of whether the request itself was logged.
  • Response analysis: A successful traversal often returns HTTP 200 with unexpected content type or size. Watch for 200 responses to unusual paths that would normally return 404.

Recommended Actions

Immediate (0–24 Hours)

• Inventory: Identify all systems running ConnectWise ScreenConnect. Include production, staging, dev, and cloud environments — untracked instances are the most likely to remain unpatched.
• Validate internet-facing exposure: Determine which of the affected systems are reachable from the public internet. Prioritize these for immediate remediation or compensating controls.

Remediation

• Apply the vendor patch: Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.
• CISA directive deadline: 2026-05-12 — this is the mandatory deadline for US federal civilian agencies under BOD 22-01. All organizations should treat this date as a strong target regardless of federal mandate.
• Verify remediation: After patching, confirm the correct version is installed on all affected hosts. Run a vulnerability scan or use your asset management tooling to verify — do not rely solely on change tickets.

Detection Coverage

• Threat intelligence feeds: Monitor your TI feeds and vendor advisory channels for published indicators of compromise (IOCs), proof-of-concept exploit releases, or active campaign reporting associated with this CVE — these should trigger an immediate hunt even if no internal alerts have fired.

Vulnerability Details

Additional Notes

https://www.connectwise.com/company/trust/security-bulletins/connectwise-screenconnect-23.9.8 ; https://nvd.nist.gov/vuln/detail/CVE-2024-1708