Screenconnect - Authentication Bypass (CVE-2024-1709)
170Exploiting IPs reported
ConnectWise ScreenConnect 23.9.7 and prior are affected by an Authentication Bypass Using an Alternate Path or Channel vulnerability, which may allow an attacker direct access to confidential information or critical systems.
CrowdSec analysis
CVE-2024-1709 is a critical authentication bypass vulnerability in ConnectWise ScreenConnect, enabling attackers to access confidential information or critical systems without proper authorization.
CrowdSec has been tracking this vulnerability and its exploits since 15th of December 2023.
According to CrowdSec data, while opportunistic exploitation dominates, a portion of threat actors trying to exploit CVE-2024-1709 apply basic targeting methods such as port or service detection. This indicates emerging patterns of selective targeting. Additionally, according to week-over-week analysis by CrowdSec, exploitation of CVE-2024-1709 is surging. Attack volumes are spiking well above historical norms, indicating widespread and escalating interest from threat actors. CVE-2024-1709 is currently experiencing high visibility and active exploitation across the internet.
Indicators of exploitation typically involve access to URLs containing /setupwizard.aspx/.
Exploitation
Get real-time information about exploitation attempts and actors involved.
Protection
Find out relevant information to protect your stack against this CVE.
Blocklist
With our advanced worldwide network detection, CrowdSec can provide a list of IPs known for exploiting the vulnerability.
To increase your protection against this CVE, block exploitation attempts with this list of identified actors.