VulnSocial
← Back to blog

CVE-2024-1708 – High‑Severity Path Traversal in ConnectWise ScreenConnect

Key takeaways

  • CVE-2024-1708 is a High‑severity (CVSS 8.4) path‑traversal flaw in ConnectWise ScreenConnect (versions ≤ 23.9.7).
  • Active exploitation confirmed by CISA KEV; attackers can achieve remote code execution and full network compromise.
  • Vendor patch (23.9.8) released; must be applied by 12 May 2026 or the service should be isolated.
  • Immediate actions: deploy the patch, restrict file‑upload extensions, monitor for anomalous file writes and outbound traffic from ScreenConnect.

Overview

On 28 April 2026, the U.S. Cybersecurity and Infrastructure Security Agency (CISA) added CVE-2024-1708 to its Known Exploited Vulnerabilities (KEV) catalog, indicating that the flaw is being actively exploited in the wild. The vulnerability resides in ConnectWise ScreenConnect (also marketed as ConnectWise Control), a remote‑access and support solution widely deployed in enterprise environments. Versions up to 23.9.7 are vulnerable.

The CVSS v3.1 base score is 8.4 (High), with a vector of AV:N/AC:L/PR:H/UI:R/S:C/C:H/I:H/A:H. The issue maps to CWE‑22 (Path Traversal).

Technical Details

The flaw is a path‑traversal vulnerability in the extensions handling component of ScreenConnect. An attacker who can authenticate to the management console with sufficient privileges (PR:H) and interacts with the upload feature (UI:R) can craft a request that traverses directories (e.g., using “../” sequences) and places a malicious file—commonly a ZIP archive containing a .aspx or .ashx payload—into an arbitrary location on the server’s file system.

When the ScreenConnect service processes the uploaded extension, the malicious payload is executed with the privileges of the service account, granting the attacker remote code execution. This can lead to:

  • Full compromise of the host running ScreenConnect.
  • Lateral movement to other systems on the network.
  • Data exfiltration or ransomware deployment.

Multiple threat‑intel sources, including Huntress and CISA, have reported active exploitation of this vulnerability since its addition to the KEV catalog.

Severity & Impact

The CVSS vector indicates that confidentiality, integrity, and availability are all impacted at the highest level (C:H/I:H/A:H). In practical terms, an attacker can gain complete control over the affected system and use it as a foothold for broader attacks.

Affected Products

  • ConnectWise ScreenConnect (self‑hosted/on‑premise) versions ≤ 23.9.7.

For a complete list of affected versions and CPE entries, see the live CVE page: https://vulnsocial.com/cve/CVE-2024-1708.

Actionable Insights – What to Do Now

  • Deploy the official patch (ScreenConnect 23.9.8 or later) without delay.
  • If patching is not immediately possible, disable the extensions upload feature or set the extensions directory to read‑only.
  • Enforce least‑privilege for the ScreenConnect service account; avoid running it as an administrator.
  • Restrict inbound access to the ScreenConnect management console to trusted IP ranges or VPN.
  • Enable detailed logging of authentication events and file uploads; set alerts for any new .aspx/.ashx files in the extensions folder.
  • Deploy IDS/IPS signatures that detect “../” traversal patterns in HTTP requests to the extensions endpoint.
  • Conduct a threat‑hunt for processes spawned by ScreenConnect that originate from unexpected file paths.

Remediation & Mitigation

  1. Apply the vendor patch – upgrade to ScreenConnect 23.9.8 or later (see ConnectWise advisory).
  2. Verify the version – confirm the installed version via the product’s “About” screen or by checking the binary version.
  3. If patching is delayed, immediately disable the extensions feature or make the extensions directory read‑only.
  4. Reduce service account privileges – run the ScreenConnect service under a non‑admin account with only the necessary file‑system rights.
  5. Network segmentation – place ScreenConnect servers on a dedicated VLAN and limit outbound connections to only required destinations.
  6. Monitor and alert – enable file‑integrity monitoring on the extensions folder and alert on any new executable files.
  7. Follow CISA KEV guidance – apply mitigations per vendor instructions, adhere to BOD 22‑01 guidance for cloud services, or discontinue use if mitigations are unavailable.

Bottom Line

CVE-2024-1708 is a high‑severity, actively exploited path‑traversal flaw in ConnectWise ScreenConnect. A vendor patch is available; apply it before the 12 May 2026 deadline or isolate the service. Implement the hardening steps above to mitigate risk while you transition.

References

#CVE20241708 #CVE #High #RCE #ConnectWise #CISAKEV #RemoteCodeExecution