[Blog](/blog) Show links Resources [Blog](/blog) [Breaches](/breaches) [eBooks, reports, & more](/resources) [Events](/events) [News](/news) [Risks and Vulnerabilities](/category/risks-and-vulnerabilities) Show links Categories [Attack Surface Management](/category/attack-surface-management) [Company News](/category/company-news) [Compliance and Regulations](/category/compliance-and-regulations) [Cybersecurity](/category/cybersecurity) [Data Breaches](/category/data-breaches) [DevOps](/category/devops) [Human Cyber Risk](/category/human-cyber-risk) [Risks and Vulnerabilities](/category/risks-and-vulnerabilities) [Third-Party Risk Management](/category/third-party-risk-management) [Vendor Risk Management](/category/vendor-risk-management) [Critical Authentication Bypass Vulnerability in ScreenConnect (CVE-2024-1709)](/blog/screenconnect-cve-2024) Publish date July 4, 2025 {x} minute read # Critical Authentication Bypass Vulnerability in ScreenConnect (CVE-2024-1709) [Get a demo](/contact-sales) [Free trial](/demo) [Download the PDF guide](#) [Free trial](/demo) Written by [Caitlin Postal](/team/caitlin-postal) Technical Writer Reviewed by [Greg Pollock](/team/greg-pollock) Director of Research and Insights Greg is a CISA-certified cybersecurity researcher who holds multiple patents for data leak detection. His findings have been featured in The New York Times, Forbes, and Wired. Table of contents Free resource ### [Download now](#) ConnectWise urges organizations using an on-premises installation of the ScreenConnect remote monitoring and management software (formerly known as ConnectWise Control) to update servers to version 23.9.8 immediately due to a critical remote code execution vulnerability. The ScreenConnect remote desktop product is at risk due to a pair of vulnerabilities: [CVE-2024-1709](https://nvd.nist.gov/vuln/detail/CVE-2024-1709) and [CVE-2024-1708](https://nvd.nist.gov/vuln/detail/CVE-2024-1708). ## ScreenConnect vulnerabilities under active exploitation Cybercriminals can chain the two vulnerabilities, leveraging the authentication bypass CVE-2024-1709 first and then moving through the system with the path traversal CVE-2024-1708. These vulnerabilities affect ScreenConnect 23.9.7 and all prior ScreenConnect versions. Because ScreenConnect provides remote access functionality, attackers targeting ConnectWise ScreenConnect may seek to compromise critical systems for organizations with on-premises or self-hosted deployments. These vulnerabilities follow a [Cybersecurity and Infrastructure Security Agency (CISA) January advisory](https://www.cisa.gov/news-events/cybersecurity-advisories/aa23-025a) that warns about a widespread campaign compromising remote monitoring and management software, including ScreenConnect, to gain persistence and control of the target network. While the previous campaign used phishing attacks to compromise legitimate RMM software, the current vulnerabilities leading to remote code execution are of additional concern as this software has previously been targeted by malicious cybercriminals and advanced persistent threats (APTs). CVE-2024-1709 is a critical vulnerability with a Common Vulnerability Scoring System (CVSS) score of 10.0, which is the highest score and indicates a complete breakdown of security measures that can be immediately exploited. The path traversal vulnerability has a CVSS score of 8.4, which indicates a high severity risk. CVE-2024-1709 is part of the CISA Known Exploited Vulnerabilities (KEV) catalog. ConnectWise announced the new vulnerabilities alongside a fix in their February 2024 [security bulletin](https://www.connectwise.com/company/trust/security-bulletins/connectwise-screenconnect-23.9.8), stating the following: > "Vulnerabilities were reported February 13, 2024, through our vulnerability disclosure channel via the ConnectWise Trust Center. There is no evidence that these vulnerabilities have been exploited in the wild, but immediate action must be taken by on-premise partners to address these identified security risks." (ConnectWise) Despite this assurance that ScreenConnect servers were not compromised, ConnectWise has received reports of suspicious activity and provided IP addresses used by threat actors as known [indicators of compromise](https://www.upguard.com/blog/indicators-of-compromise) (IoCs). ConnectWise shared that the cloud-based offerings, `[.rt-script]screenconnect.com[.rt-script]` or `[.rt-script]hostedrmm.com[.rt-script]`, have already been secured against these vulnerabilities. Multiple threat intelligence groups have released working proof-of-concept exploits (PoCs) that illustrate how hackers can exploit this set of vulnerabilities. The [Huntress PoC](https://www.huntress.com/blog/a-catastrophe-for-control-understanding-the-screenconnect-authentication-bypass) demonstrates the ease with which an attacker can compromise the ScreenConnect setup wizard and bypass authentication requirements on an existing ScreenConnect server, overwriting the user database with a new administrative user. Appending a forward slash `[.rt-script]/[.rt-script]` to the `[.rt-script]SetupWizard.aspx[.rt-script]` request URL bypasses the HTTP request filter that should deny new setups on existing ScreenConnect servers. > "Once you have administrative access to a compromised instance, it is trivial to create and upload a malicious ScreenConnect extension to gain Remote Code Execution (RCE)." (Huntress) If an attacker gains access to your system, they can exploit CVE-2024-1708 to run arbitrary code and modify existing files on the server. Malicious actors may install malware or ransomware, or they may gain access to customer endpoints available in the provider's ScreenConnect server. ## How to respond to the ScreenConnect vulnerabilities If you use ScreenConnect, you should immediately apply the security update from ConnectWise. Because these two vulnerabilities can be combined by threat actors to gain access and lateral movement within your system, it is critical to protect against the vulnerability before an attacker exploits it on your system. ### Run the ScreenConnect update for on-premises servers The ConnectWise [security bulletin](https://www.connectwise.com/company/trust/security-bulletins/connectwise-screenconnect-23.9.8) instructs organizations to upgrade to the latest version of ScreenConnect (23.9.10.8817 at the time of publication). If you are using version 23.9.8, then your server should be protected against the reported vulnerabilities. ### Investigate indicators of compromise Both ConnectWise and threat intelligence researchers have released potential indicators of compromise identified during investigation into these vulnerabilities. You should evaluate your server to assess whether it has been compromised, following your organization's [incident response](https://www.google.com/search?q=site%3Aupguard.com%2Fblog+incident+response\&oq=site%3Aupguard.com%2Fblog+incident+\&gs_lcrp=EgZjaHJvbWUqBggAEEUYOzIGCAAQRRg7MgYIARBFGDkyBggCEEUYQDIGCAMQRRg60gEINDkyOGowajeoAgCwAgA\&sourceid=chrome\&ie=UTF-8#:~:text=How%20to%20Create,creating%2Da%2Dcyber%2D...) plan for quarantine and recovery if the vulnerabilities on your server were exploited. ConnectWise reported that the following IP addresses were used by threat actors: * `[.rt-script]155.133.5.15[.rt-script]` * `[.rt-script]155.133.5.14[.rt-script]` * `[.rt-script]118.69.65.60[.rt-script]` You can additionally use the ScreenConnect audit page to review login attempts for unauthorized users or IP addresses. Horizon3 and GreyNoise have also partnered on a [malicious activity tag](https://viz.greynoise.io/tags/connectwise-screenconnect-auth-bypass-rce-attempt) to monitor additional IP addresses that attempt the bypass exploitation. The Huntress intelligence team has provided [detection guidance](https://www.huntress.com/blog/detection-guidance-for-connectwise-cwe-288-2) that uses the Advanced Auditing policy to log file changes indicative of an attacker's presence on the server. Their recommendation uses the [Windows Event 4663](https://learn.microsoft.com/en-us/windows/security/threat-protection/auditing/event-4663) to log when the `[.rt-script]User.xml[.rt-script]` file is modified, such as when the setup wizard creates new users. Huntress also identified a malicious `[.rt-script]SetUpWizard.aspx[.rt-script]` URL path in the Microsoft Internet Information Services (IIS) audit log. You can use this information as a starting point for your investigation though you may need to conduct additional forensic analysis to determine whether your server has been compromised due to these vulnerabilities. ### Automate continuous monitoring across your public attack surface Continuous monitoring of your external attack surface can help you take proactive measures against any potential known and unknown vulnerabilities. UpGuard maintains a vulnerability library for customers using [Breach Risk](https://www.upguard.com/product/breach-risk) and [Vendor Risk](https://www.upguard.com/product/vendorrisk) to help organizations identify issues that need mitigation. If you or a vendor use ScreenConnect, you should determine whether it has been updated to a secure version. UpGuard users can search for **CVE-2024-1709** in the Vulnerabilities module to identify whether ScreenConnect poses a risk, or you can search for ScreenConnect by name in the Portfolio Risk Profile. Free resource ### [Download now](#) ## Related posts Learn more about the latest issues in cybersecurity. Risks and Vulnerabilities #### [25 Security Vulnerabilities That Have Defined the 2020s (Thus Far)](/blog/top-25-security-vulnerabilities-of-the-2020s) From Log4j to SolarWinds, discover the 25 critical security vulnerabilities that have reshaped cybersecurity thus far in the 2020s. [](/team/nicholas-sollitto) [Nicholas Sollitto](#) May 28, 2026 Risks and Vulnerabilities #### [ServiceNow Vulnerabilities: CVE-2024-4789 and CVE-2024-5217](/blog/servicenow-vulnerabilities) Learn about two critical vulnerabilities affecting the ServiceNow platform (CVE-2024-4789 and CVE-2024-5217) and how UpGuard can help. [](/team/nicholas-sollitto) [Nicholas Sollitto](#) January 16, 2025 Risks and Vulnerabilities #### [PHP2Shell: A Clear Explanation and Response Framework](/blog/php2shell-a-clear-explanation-and-response-framework) PHP2Shell (CVE-2026-109618 and CVE-2026-109619) lets unauthenticated attackers run code on PHP servers. Learn who’s affected and how to respond. [](/team/upguard) [UpGuard Team](#) October 22, 2026 Risks and Vulnerabilities #### [Everything Everywhere: Systemic Data Exposure in Supabase Apps](/blog/everything-everywhere-systemic-data-exposure-in-supabase-apps) Supabase is a favorite of AI coding agents. It's also prone to misconfiguration. We studied more than 16,000 open databases to see what's leaking. [](/team/greg-pollock) [Greg Pollock](#) October 14, 2026 Risks and Vulnerabilities #### [Oracle Just Shipped 1,449 Security Patches in One Quarter. We Checked How Much of It Is Actually New.](/blog/oracle-just-shipped-1-449-security-patches-in-one-quarter-we-checked-how-much-of-it-is-actually-new) Oracle's July 2026 update shipped 1,449 security patches — 2.8x its all-time record. We parsed 23 quarters of advisories to find out how much is truly new. [](/team/greg-pollock) [Greg Pollock](#) July 22, 2026 Risks and Vulnerabilities #### [Data leakage risks with DBHub MCP servers](/blog/data-leakage-risks-with-dbhub-mcp-servers) UpGuard found exposed DBHub servers leaking live databases to the open internet—an early sign that MCP exposure is becoming a systemic data risk. [](/team/greg-pollock) [Greg Pollock](#) October 13, 2026 [All posts](/blog) Experience superior visibility and a simpler approach to cyber risk management [Get a demo](/contact-sales) [Free trial](/demo)