Svi
Pretraži prema proizvođaču
Pretraži prema CWE oznaci
O usluzi
Pretplate
Jezik
hr
en
CVE-2024-1709 - CERT CVE
CVE-2024-1709
ID
CVE-2024-1709
Sažetak
ConnectWise ScreenConnect 23.9.7 and prior are affected by an Authentication Bypass Using an Alternate Path or Channel vulnerability, which may allow an attacker direct access to confidential information or critical systems.
Reference
https://github.com/rapid7/metasploit-framework/pull/18870
https://github.com/watchtowrlabs/connectwise-screenconnect_auth-bypass-add-user-poc
https://techcrunch.com/2024/02/21/researchers-warn-high-risk-connectwise-flaw-under-attack-is-embarrassingly-easy-to-exploit/
https://www.bleepingcomputer.com/news/security/connectwise-urges-screenconnect-admins-to-patch-critical-rce-flaw/
https://www.connectwise.com/company/trust/security-bulletins/connectwise-screenconnect-23.9.8
https://www.horizon3.ai/attack-research/red-team/connectwise-screenconnect-auth-bypass-deep-dive/
https://www.huntress.com/blog/a-catastrophe-for-control-understanding-the-screenconnect-authentication-bypass
https://www.huntress.com/blog/detection-guidance-for-connectwise-cwe-288-2
https://www.huntress.com/blog/vulnerability-reproduced-immediately-patch-screenconnect-23-9-8
https://www.securityweek.com/connectwise-confirms-screenconnect-flaw-under-active-exploitation/
https://github.com/rapid7/metasploit-framework/pull/18870
https://github.com/watchtowrlabs/connectwise-screenconnect_auth-bypass-add-user-poc
https://techcrunch.com/2024/02/21/researchers-warn-high-risk-connectwise-flaw-under-attack-is-embarrassingly-easy-to-exploit/
https://www.bleepingcomputer.com/news/security/connectwise-urges-screenconnect-admins-to-patch-critical-rce-flaw/
https://www.connectwise.com/company/trust/security-bulletins/connectwise-screenconnect-23.9.8
https://www.horizon3.ai/attack-research/red-team/connectwise-screenconnect-auth-bypass-deep-dive/
https://www.huntress.com/blog/a-catastrophe-for-control-understanding-the-screenconnect-authentication-bypass
https://www.huntress.com/blog/detection-guidance-for-connectwise-cwe-288-2
https://www.huntress.com/blog/vulnerability-reproduced-immediately-patch-screenconnect-23-9-8
https://www.securityweek.com/connectwise-confirms-screenconnect-flaw-under-active-exploitation/
https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2024-1709
CVSS
Base:
10.0
Impact:
6.0
Exploitability:
3.9
Pristup
Vektor
Složenost
Autentikacija
NETWORK
LOW
NONE
Impact
Povjerljivost
Cjelovitost
Dostupnost
HIGH
HIGH
HIGH
CVSS vektor
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H
Zadnje važnije ažuriranje
26-02-2026 - 15:04
Objavljeno
21-02-2024 - 16:15