CVE-2024-1708

Name of the Vulnerable Software and Affected Versions ConnectWise ScreenConnect versions prior to 23.9.8

Description A path traversal flaw exists due to improper restriction of directory path names. This allows a remote attacker to bypass directory restrictions, potentially enabling the upload of malicious extensions to achieve remote code execution. Such exploitation can directly impact critical systems and confidential data. Real-world incidents have confirmed active exploitation, where attackers used the flaw to perform privilege escalation and lateral movement across connected client networks.

Recommendations Update ConnectWise ScreenConnect to version 23.9.8 or later. Review system logs for signs of compromise. Rotate all credentials. Implement runtime segmentation to limit the potential impact of a compromised management infrastructure.