CVE-2024-1708
HIGH KEV RANSOMWAREConnectWise ScreenConnect Unauthenticated Remote Code Execution
Title source: metasploitExploitation Summary
CVE-2024-1708 is actively exploited and listed in the CISA Known Exploited Vulnerabilities (KEV) catalog, added April 28, 2026, with confirmed use in ransomware campaigns.
EIP tracks 4 public exploits from researchers including tdawg506, Teexo, sfewer-r7, WatchTowr, including a Metasploit module exploits/multi/http/connectwise_screenconnect_rce_cve_2024_1709.
AI-analyzed exploit summary This repository contains a functional Python exploit for CVE-2024-1708 (authentication bypass) and CVE-2024-1709 (RCE) in ConnectWise ScreenConnect. The tool checks for vulnerability and provides exploitation guidance, including admin endpoint discovery and setup mode detection.
Description
ConnectWise ScreenConnect 23.9.7 and prior are affected by path-traversal vulnerability, which may allow an attacker the ability to execute remote code or directly impact confidential data or critical systems.
Exploits (4)
This repository contains a functional Python exploit for CVE-2024-1708 (authentication bypass) and CVE-2024-1709 (RCE) in ConnectWise ScreenConnect. The tool checks for vulnerability and provides exploitation guidance, including admin endpoint discovery and setup mode detection.
This repository contains a functional Python exploit for CVE-2024-1708 (authentication bypass) and CVE-2024-1709 (RCE) in ConnectWise ScreenConnect. The tool checks for vulnerability and provides exploitation guidance, including admin endpoint discovery and setup mode detection.
This repository contains a functional exploit for CVE-2024-1708, which targets a vulnerability in a web application (likely a .NET-based system). The exploit involves uploading a malicious extension (ASHX handler) to achieve remote code execution (RCE) by leveraging an authenticated endpoint.
This Metasploit module exploits CVE-2024-1709 (auth bypass) and CVE-2024-1708 (path traversal) in ConnectWise ScreenConnect to create an admin account and achieve RCE via malicious extension upload. It supports Windows and Linux targets.
References (4)
Scores
CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:H/I:H/A:H