[HIGH PRIORITY] ConnectWise ScreenConnect Authentication Bypass (CVE-2024-1709)

⚠ HIGH PRIORITY — CISA KEV. CVE-2024-1709 is an authentication bypass in ConnectWise ScreenConnect remote access software. Attackers create admin accounts and deploy ransomware without valid credentials — widely exploited in Q1 2024 campaigns.

Affected ScreenConnect

• ScreenConnect 23.9.7 and earlier
• Self-hosted ScreenConnect on Windows or Linux (port 8040/443)
• MSP environments with hundreds of downstream endpoints

Detect exposure

nmap -p 8040,443 --script http-title msp-subnet/24
curl -sk https://support.example.com:8040/ | grep -i screenconnect

Patching Method

1. Upgrade to ScreenConnect 23.9.8+ immediately from ConnectWise portal.
2. Linux host: stop service, backup /opt/screenconnect, run vendor upgrade script or replace WAR/JAR per release notes.
3. Windows host: run ConnectWise installer over existing install.
4. Restart ScreenConnect service; confirm version in admin About page.
5. Audit Users tab for unknown admin accounts created in last 30 days.
6. Review connected sessions and extension inventory for rogue plugins.

# Linux — verify version after patch
systemctl status screenconnect
grep -i version /opt/screenconnect/App_Data/*.xml 2>/dev/null

Post-patch

• Enable MFA for all ScreenConnect admins
• Block ScreenConnect ports from public internet — require VPN
• Notify customers if MSP-hosted instance was exposed