ZeroDay Findings
Sign inSign up

Findings

CVE-2024-1709

ConnectWise ScreenConnect Authentication Bypass Vulnerability

Published Feb 21, 2024 · updated Jun 17, 2026 · connectwise screenconnect

ConnectWise ScreenConnect 23.9.7 and prior are affected by an Authentication Bypass Using an Alternate Path or Channel vulnerability, which may allow an attacker direct access to confidential information or critical systems.

Timeline

Detection, updates, and resolution for this record.

  1. Feb 21, 2024 · Catalog

    Detected

    ConnectWise ScreenConnect 23.9.7 and prior are affected by an Authentication Bypass Using an Alternate Path or Channel vulnerability, which may allow an attacker direct access to confidential information or critical systems.

  2. Feb 22, 2024 · CISA KEV

    Known exploited

    Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.

  3. Feb 29, 2024 · CISA KEV

    Remediation due

    Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.

  4. Jun 17, 2026 · Catalog

    Updated

    ConnectWise ScreenConnect 23.9.7 and prior are affected by an Authentication Bypass Using an Alternate Path or Channel vulnerability, which may allow an attacker direct access to confidential information or critical systems.

Required action

Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.

CISA due date Feb 29, 2024

Affected

  • cpe connectwise/screenconnectversion unspecified
  • vendor ConnectWise ScreenConnectversion unspecified

Sources

  • CISA KEVCVE-2024-1709

    ConnectWise ScreenConnect contains an authentication bypass vulnerability that allows an attacker with network access to the management interface to create a new, administrator-level account on affected devices.

    cisa.gov
  • CVE.orgCVE-2024-1709

    Official CVE identifier

    cve.org
  • FIRST EPSSCVE-2024-1709

    30-day exploitation probability 100.0%

    first.org
  • Metasploit Modulesexploit_multi/http/connectwise_screenconnect_rce_cve_2024_1709

    Public module reference (excellent). Module source is not copied into this catalog.

    rapid7.com
  • NIST NVDCVE-2024-1709

    ConnectWise ScreenConnect 23.9.7 and prior are affected by an Authentication Bypass Using an Alternate Path or Channel vulnerability, which may allow an attacker direct access to confidential information or critical systems.

    nvd.nist.gov

References