ConnectWise ScreenConnect Vulnerabilities Under Active Exploitation
Recently disclosed vulnerabilities in the remote desktop application ConnectWise ScreenConnect are being exploited to deliver a variety of different malicious payloads into business environments. The vulnerabilities were first disclosed by ConnectWise on February 13, 2024, and attacks exploiting the vulnerabilities started a day after the patches were released. One of the vulnerabilities, CVE-2024-1709, is an authentication bypass flaw with a maximum CVSS severity score of 10. The other, CVE-2024-1708, is a high-severity path traversal vulnerability with a CVSS severity score of 8.4.
Due to the severity of the flaws and the high risk of exploitation, ConnectWise urged admins to update their on-premise servers to the fixed version immediately. Proof-of-concept (PoC) exploits were published soon after the disclosure and within 24 hours of the emergency patches being released, hackers started exploiting the flaws. According to Palo Alto Networks, there are around 18,000 IP addresses hosting ScreenConnect, although as of February 20, 2023, the ShadowServer Foundation reports that the majority have been updated. As of February 20, 2024, around 3,800 ScreenConnect connect servers remained exposed.
According to researchers from Huntress, a specially crafted request can be sent to a vulnerable ScreenConnect server that allows the setup wizard to be used, even though ScreenConnect has already been set up, which allows an attacker to create a new administrator account and take full control of the ScreenConnect instance. The Cybersecurity and Infrastructure Security Agency added the CVE-2024-1709 vulnerability to its Known Exploited Vulnerability Catalog on February 22, 2024.
The vulnerabilities affect ScreenConnect servers running version 23.9.7 and earlier. ConnectWise has confirmed that all screenconnect.com cloud or hostedrmm.com instances have been secured. On-premise users must update to ConnectWise ScreenConnect 23.9.8 to prevent exploitation of the flaws.
Get The FREE
HIPAA Compliance Checklist
Immediate Delivery of Checklist Link To Your Email Address
Please Enter Correct Email Address
Your Privacy Respected
HIPAA Journal Privacy Policy
