CVE-2024-1708

HIGH KEV RANSOMWARE

ConnectWise ScreenConnect Unauthenticated Remote Code Execution

Title source: metasploit
STIX 2.1

Exploitation Summary

CVE-2024-1708 is actively exploited and listed in the CISA Known Exploited Vulnerabilities (KEV) catalog, added April 28, 2026, with confirmed use in ransomware campaigns. EIP tracks 4 public exploits from researchers including tdawg506, Teexo, sfewer-r7, WatchTowr, including a Metasploit module exploits/multi/http/connectwise_screenconnect_rce_cve_2024_1709.

AI-analyzed exploit summary This repository contains a functional Python exploit for CVE-2024-1708 (authentication bypass) and CVE-2024-1709 (RCE) in ConnectWise ScreenConnect. The tool checks for vulnerability and provides exploitation guidance, including admin endpoint discovery and setup mode detection.

Description

ConnectWise ScreenConnect 23.9.7 and prior are affected by path-traversal vulnerability, which may allow an attacker the ability to execute remote code or directly impact confidential data or critical systems.

Exploits (4)

github WORKING POC 1 stars
by tdawg506 · pythonpoc
https://github.com/tdawg506/ScreenConnect-CVE-2024-1709-Exploit

This repository contains a functional Python exploit for CVE-2024-1708 (authentication bypass) and CVE-2024-1709 (RCE) in ConnectWise ScreenConnect. The tool checks for vulnerability and provides exploitation guidance, including admin endpoint discovery and setup mode detection.

Classification
Working Poc 95%
Attack Type
Auth Bypass | Rce
Complexity
Moderate
Reliability
Reliable
Target: ConnectWise ScreenConnect (ConnectWise Control)
No auth needed
Prerequisites: Python 3.x · requests library · target URL · listener IP/port for reverse shell
devstral-2 · analyzed May 15, 2026 Full analysis →
github WORKING POC 1 stars
by Teexo · pythonremote
https://github.com/Teexo/ScreenConnect-CVE-2024-1709-Exploit

This repository contains a functional Python exploit for CVE-2024-1708 (authentication bypass) and CVE-2024-1709 (RCE) in ConnectWise ScreenConnect. The tool checks for vulnerability and provides exploitation guidance, including admin endpoint discovery and setup mode detection.

Classification
Working Poc 90%
Attack Type
Auth Bypass
Complexity
Moderate
Reliability
Reliable
Target: ConnectWise ScreenConnect (ConnectWise Control)
No auth needed
Prerequisites: Python 3.x · requests library
devstral-2 · analyzed Feb 19, 2026 Full analysis →
vulncheck_xdb WORKING POC
remote
https://github.com/cjybao/CVE-2024-1709-and-CVE-2024-1708

This repository contains a functional exploit for CVE-2024-1708, which targets a vulnerability in a web application (likely a .NET-based system). The exploit involves uploading a malicious extension (ASHX handler) to achieve remote code execution (RCE) by leveraging an authenticated endpoint.

Classification
Working Poc 95%
Attack Type
Rce
Complexity
Moderate
Reliability
Reliable
Target: Unknown .NET-based web application (likely a CMS or similar)
Auth required
Prerequisites: Valid credentials for authentication · Access to the target web application
devstral-2 · analyzed Feb 25, 2026 Full analysis →
metasploit WORKING POC EXCELLENT
by sfewer-r7, WatchTowr · rubypocwin
https://github.com/rapid7/metasploit-framework/blob/master/modules/exploits/multi/http/connectwise_screenconnect_rce_cve_2024_1709.rb

This Metasploit module exploits CVE-2024-1709 (auth bypass) and CVE-2024-1708 (path traversal) in ConnectWise ScreenConnect to create an admin account and achieve RCE via malicious extension upload. It supports Windows and Linux targets.

Classification
Working Poc 100%
Attack Type
Rce
Complexity
Moderate
Reliability
Reliable
Target: ConnectWise ScreenConnect <= 23.9.7
No auth needed
Prerequisites: Network access to ScreenConnect server (default port 8040) · Vulnerable version of ScreenConnect
devstral-2 · analyzed Feb 16, 2026 Full analysis →

Scores

CVSS v3 8.4
EPSS 0.8481
EPSS Percentile 99.4%
Attack Vector NETWORK
CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:H/I:H/A:H

CISA SSVC

Vulnrichment
Exploitation active
Automatable no
Technical Impact total

Details

CISA KEV 2026-04-28
VulnCheck KEV 2024-02-22
InTheWild.io 2024-02-19
ENISA EUVD EUVD-2024-17442
Ransomware Use Confirmed
CWE
CWE-22
Status published
Products (2)
ConnectWise/ScreenConnect < 23.9.7
connectwise/screenconnect < 23.9.8
Published Feb 21, 2024
KEV Added Apr 28, 2026
Tracked Since Feb 18, 2026