CVE-2024-1709

CVE-2024-1709 is a critical vulnerability in the ConnectWise ScreenConnect software that allows for an authentication bypass. This flaw can enable a remote non-authenticated attacker to bypass the system's authentication process and gain full access. The issue was identified by Sophos Rapid Response, which developed SQL scripts to identify machines running versions of ScreenConnect Server vulnerable to this exploit. Despite the release of patches to address these vulnerabilities, many systems remain exposed due to insufficient update practices. The exploitation of this vulnerability has been linked to numerous cyberattacks involving the delivery of various malicious payloads. Among the threat actors exploiting this flaw are the BlackCat, Black Basta, and Bloody ransomware groups. These attackers have used CVE-2024-1709 to create admin accounts, delete existing users, and take over vulnerable instances, causing significant damage and disruption to affected organizations. Notably, the BlackCat group denied using this vulnerability in attacks on Change Healthcare's network, despite contrary reports from sources familiar with the investigation. In response to these threats, Check Point's IPS blade provides protection against these exploits, including the ConnectWise ScreenConnect Remote Code Execution (CVE-2024-1708) and the ConnectWise ScreenConnect Authentication Bypass (CVE-2024-1709). However, the continued exploitation of CVE-2024-1709 underscores the importance of prompt patch application and robust cybersecurity practices to protect against these types of vulnerabilities.