ConnectWise ScreenConnect <= 23.9.7 - Path Traversal

Exploited in the wild. Listed by CISA on 2026-04-28; known to be used by ransomware.

highseverity

8.4CVSS score

95.4%likelihood of exploitation, next 30 days

100%of all CVEs are less likely

Readycheck to confirm it

ConnectWise ScreenConnect 23.9.7 and prior contain a path traversal caused by improper handling of user input, letting attackers execute remote code or access confidential data, exploit requires network access.

Impact

Attackers can execute remote code or access sensitive data, potentially leading to full system compromise or data breach.

Fix

Update to the latest version of ConnectWise ScreenConnect.

How to confirm it

Send: GET /
Positive when: contains(header, "ScreenConnect/") and compare_versions(version, '<= 23.9.7')

Run it with nuclei: nuclei -id CVE-2024-1708 -u <target>

The full check

id: CVE-2024-1708

info:
  name: ConnectWise ScreenConnect <= 23.9.7 - Path Traversal
  author: popy21
  severity: high
  description: |
    ConnectWise ScreenConnect 23.9.7 and prior contain a path traversal caused by improper handling of user input, letting attackers execute remote code or access confidential data, exploit requires network access.
  impact: |
    Attackers can execute remote code or access sensitive data, potentially leading to full system compromise or data breach.
  remediation: |
    Update to the latest version of ConnectWise ScreenConnect.
  reference:
    - https://www.connectwise.com/company/trust/security-bulletins/connectwise-screenconnect-23.9.8
    - https://www.huntress.com/blog/a-catastrophe-for-control-understanding-the-screenconnect-authentication-bypass
    - https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2024-1708
    - https://nvd.nist.gov/vuln/detail/CVE-2024-1708
  classification:
    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:H/I:H/A:H
    cvss-score: 8.4
    cve-id: CVE-2024-1708
    epss-score: 0.95436
    epss-percentile: 0.99868
    cwe-id: CWE-22
  metadata:
    verified: true
    max-request: 1
    vendor: connectwise
    product: screenconnect
    shodan-query: http.favicon.hash:-82958153
    fofa-query: icon_hash=-82958153
  tags: cve,cve2024,connectwise,screenconnect,lfi,kev,vkev

http:
  - raw:
      - |
        GET / HTTP/1.1
        Host: {{Hostname}}

    matchers:
      - type: dsl
        dsl:
          - contains(header, "ScreenConnect/")
          - compare_versions(version, '<= 23.9.7')
        condition: and

    extractors:
      - type: regex
        name: version
        part: header
        group: 1
        regex:
          - 'ScreenConnect/([0-9]+\.[0-9]+\.[0-9]+)'
        internal: true

      - type: regex
        part: header
        group: 1
        regex:
          - 'ScreenConnect/([0-9]+\.[0-9]+\.[0-9]+)'

References

Use this check only on systems you are authorised to test. Where the data comes from