ConnectWise ScreenConnect Vulnerabilities (CVE-2024-1708 and CVE-2024-1709)

What is the Vulnerability?
On February 19, 2024, ConnectWise published a security advisory for their remote desktop application software called ScreenConnect. One of the flaws, CVE-2024-1709 is an authentication bypass vulnerability that could let attackers gain administrative access to a ScreenConnect instance. That vulnerability has a public proof-of-concept (PoC) available and recently been added to CISA's known exploited catalog. The second flaw tracked as CVE-2024-1708 is a path traversal vulnerability that may allow an attacker to execute remote code.

What …

access advisory application attackers authentication authentication bypass bypass bypass vulnerability called concept connectwise connectwise screenconnect cve cve-2024-1708 cve-2024-1709 desktop desktop application february flaws instance poc proof proof-of-concept public remote desktop screenconnect security security advisory software vulnerabilities vulnerability what is