CVE-2024-1708

Think of ScreenConnect like a receptionist desk that should only allow staff to open certain “safe” drawers. This flaw lets a malicious, highly privileged person slip past the desk’s drawer rules and reach files in other places they shouldn’t, which can then lead to takeover or stealing sensitive information. Because it’s been used in real-world ransomware activity, it’s a high-priority fix.

This matters if your business uses or hosts ConnectWise ScreenConnect and you have it running at version 23.9.7 or earlier. The issue needs a high-privilege position inside the application (it’s not a casual “anyone on the internet” trick). It is also only a risk when an attacker can reach and leverage the ScreenConnect environment and gain the required level of access to use the vulnerable functionality.

This is RED because CISA’s KEV list ties CVE-2024-1708 to real ransomware campaigns, meaning attackers have demonstrated they can use it. Acting quickly is critical to prevent a high-privilege attacker from reading sensitive files or escalating toward full compromise. CISA’s remediation due date is 2026-05-12.

1. Confirm exposure (version check)

   • Identify the installed ConnectWise ScreenConnect version(s).
   • Treat your system as affected if you are running ScreenConnect 23.9.7 or prior.

2. Upgrade to the fixed version

   • Upgrade to ConnectWise ScreenConnect 23.9.8.
   • If you operate multiple nodes/environments (production, staging, customer-facing instances), ensure each one is upgraded.

3. Validate after upgrade

   • Confirm the running build/version now shows 23.9.8.
   • Review logs for signs of abnormal file/path access attempts or unexpected administrative actions before/around the suspected intrusion window.

4. If you cannot upgrade immediately

   • Follow ConnectWise mitigation guidance referenced with the 23.9.8 security bulletin.
   • Reduce risk by restricting how external users can reach ScreenConnect (network access controls, access allowlists) so attackers have fewer opportunities to reach the vulnerable functionality.

5. What to monitor

   • Repeated access attempts to unexpected resources.
   • Any administrative actions that don’t match your staff’s normal behavior.
   • Indicators of follow-on ransomware behavior (new scheduled tasks, suspicious service changes, or unusual command execution), since KEV indicates ransomware use in the wild.

6. CISA timing

   • CISA remediation due date: 2026-05-12.

CVE-2024-1708 is a path traversal issue (CWE-22) in ConnectWise ScreenConnect (23.9.7 and earlier). The mechanism is improper limitation of a pathname to a restricted directory, which can let a high-privilege attacker access files outside the intended directories, supporting unauthorized code execution and/or sensitive information access.

Exploitation status: CISA KEV lists this vulnerability as exploited in ransomware campaigns, which makes it an established, real-world threat rather than a theoretical issue. The fix is available in ScreenConnect 23.9.8.

Operational relevance: The reported prerequisites indicate authentication/privilege requirements inside the application (the findings describe high-level privileges required). Even with these constraints, ransomware operators may obtain the needed access as part of an earlier compromise chain.

No public exploit code was found in the provided findings, and EPSS is listed as a prediction; however, KEV status is the primary driver of urgency here.