Critical vulnerability in ConnectWise’s ScreenConnect

An alert has been issued to users of ConnectWise’s ScreenConnect software on any platform.

These vulnerabilities impact the version 23.9.7 and prior.

Customers are encouraged to patch to the latest version of ScreenConnect.

Background / What has happened?

• ConnectWise have posted a security advisory and patch to address the vulnerabilitiy in CVE-2024-1709.
• CVE-2024-1709 is a vulnerability that could allow an unauthenticated attacker to remotely run arbitrary code without user interaction via creation of a new account with administrator privileges.
• All users of ConnectWise’s ScreenConnect are encouraged to update to the patched version immediately.
• ConnectWise has confirmed active exploitation.

Affected versions / applications:

• CVE-2024-1709: This vulnerability impacts all versions of ConnectWise’s ScreenConnect from 23.9.7 and prior.

Mitigation / How do I stay secure?

• The ASD’s ACSC recommends individuals, business, organisations and government entities patch to the latest version of ScreenConnect.
• Customers who are using ScreenConnect should look for recently created administrative user accounts.
• It is currently unclear if patching will remove created administrative accounts, therefore further investigation and remediation is required.
• Indicators of compromise (IOCs) can be be found in ConnectWise’s security release.

Organisations or individuals that have been impacted or require assistance can contact 1300 CYBER1 (1300 292 371).

About Author

AndyC

Andy Curtis is an award-winning security consultant, researcher and public speaker. He has been working in the computer security industry since the early 1990s, having been employed by state and federal government, leading healthcare and banking providers across three continents. He has given talks about computer security for some of the world’s largest companies, worked with law enforcement agencies on investigations into hacking groups, and is a regular voice on TV and radio explaining IT security threats.

See author's posts