CVE-2024-1708

CVE-2024-1708 is a high-severity software vulnerability found in ConnectWise's ScreenConnect software, specifically targeting versions 23.9.7 and earlier. The flaw was officially disclosed by ConnectWise on February 19, 2024. This vulnerability, alongside another (CVE-2024-1709), presents significant security risks due to the presence of an authentication bypass issue and a path traversal problem. Cybercriminals can exploit these vulnerabilities to gain initial access to systems, move laterally within them, and potentially compromise critical data and systems. Within 24 hours of disclosure, several LockBit attacks were observed exploiting these vulnerabilities, as reported by Sophos' threat response task force. Notably, the path traversal issue (CVE-2024-1708) allows a remote privileged user to read arbitrary files on the system using a specially crafted HTTP request. Furthermore, this vulnerability has been exploited by numerous initial access brokers and threat groups to deliver ransomware, posing a severe risk to affected systems. In response to these threats, Check Point IPS blade has provided protection against both the ConnectWise ScreenConnect Remote Code Execution (CVE-2024-1708) and the ConnectWise ScreenConnect Authentication Bypass (CVE-2024-1709). To mitigate these vulnerabilities, users of ConnectWise ScreenConnect are urged to update their software to the latest version, which contains patches for these flaws.