CVE-2024-1708: ConnectWise ScreenConnect Path Traversal Vulnerability
ConnectWise ScreenConnect contains a path traversal vulnerability which could allow an attacker to execute remote code or directly impact confidential data and critical systems.
Overview
ConnectWise ScreenConnect versions through 23.9.7 contain a path traversal flaw that allows an attacker to read or write files outside the application's intended directory boundaries, with potential consequences including remote code execution and direct access to confidential data. On-premises deployments are the affected population; ConnectWise patched cloud-hosted instances directly. This vulnerability has been exploited in ransomware operations, including campaigns attributed to the Medusa ransomware group.
Vulnerability details
Path traversal (CWE-22) occurs when an application accepts user-supplied file path input without adequately restricting directory-climbing sequences, allowing the supplied path to resolve outside the intended working directory. In ScreenConnect, the flaw is reachable via the web interface by a high-privileged authenticated session. Because the application does not sanitize traversal sequences in the path parameter before resolving it on the file system, a crafted request can direct file operations to arbitrary locations on the server, outside the directories the application is designed to access.
An attacker who holds an administrator-level session on the ScreenConnect instance can submit a crafted HTTP request containing directory-climbing sequences to the ScreenConnect web interface. The authentication bypass disclosed alongside this flaw can satisfy the privilege precondition before this traversal is attempted. Successful exploitation gives the attacker the ability to execute code remotely on the ScreenConnect server or to read and write files containing confidential data and critical system configuration. Microsoft has attributed exploitation of this vulnerability, chained with the companion authentication bypass, to Storm-1175 in high-tempo Medusa ransomware operations targeting healthcare, education, finance, and professional services organizations.
Severity and impact
Exploitation status
This vulnerability is confirmed as actively exploited in the wild — it is listed in CISA's Known Exploited Vulnerabilities (KEV) catalog.
Detection and monitoring
- Monitor ScreenConnect web server logs for requests containing path-traversal sequences (encoded or literal dot-dot sequences) in file path parameters, particularly from sessions authenticated at administrator privilege level.
- Check network connection logs from ScreenConnect hosts for traffic to or from the three IP addresses published by ConnectWise as indicators of compromise: 155.133.5.15, 155.133.5.14, and 118.69.65.60.
Remediation
Additional hardening
- Upgrade on-premises ScreenConnect instances to version 23.9.8 or later; this is the minimum version that remediates the reported vulnerabilities. Partners not on active maintenance should upgrade to at least version 22.4.20001 as an interim step.
- Restrict network access to the ScreenConnect web interface to known administrative IP ranges; reducing internet exposure narrows the population of attackers who can reach the authentication layer and attempt this flaw.
- Review and audit all administrator-level accounts on ScreenConnect instances, removing or disabling accounts that are not actively needed, to reduce the number of sessions that could satisfy the high-privilege precondition for this flaw.
- If immediate patching is not possible, ConnectWise's own mitigation suspends unpatched on-premises instances detected below version 23.9.8; confirm this control is active and monitor for the associated alert indicating an outdated instance has been identified.
Key dates
References
- https://www.connectwise.com/company/trust/security-bulletins/connectwise-screenconnect-23.9.8
- https://nvd.nist.gov/vuln/detail/CVE-2024-1708
- https://www.huntress.com/blog/a-catastrophe-for-control-understanding-the-screenconnect-authentication-bypass
- https://www.microsoft.com/en-us/security/blog/2026/04/06/storm-1175-focuses-gaze-on-vulnerable-web-facing-assets-in-high-tempo-medusa-ransomware-operations/
- https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2024-1708
Frequently asked questions
Does CVE-2024-1708 affect my FedRAMP authorization?
If ConnectWise ScreenConnect runs inside your authorization boundary, yes. CVE-2024-1708 appears on CISA's Known Exploited Vulnerabilities (KEV) catalog, and its remediation deadline of May 12, 2026 has already passed. For a FedRAMP-authorized service, an unpatched KEV in your boundary is a finding. An overdue one is a finding your assessor and sponsoring agency can already see. Your options now are to remediate it or formally document the mitigation and the delay.
How does Knox help me handle CVE-2024-1708?
Knox does not patch your software. Remediating ConnectWise ScreenConnect is your responsibility under the FedRAMP shared-responsibility model. What Knox provides is the pre-authorized, single-tenant boundary to remediate within, plus continuous compliance monitoring and audit-artifact coverage to help you document the fix for your next assessment. The remediation work is yours to carry out; maintaining a compliant posture while you do it is not something you have to manage on your own.
How does Knox's monitoring help with vulnerabilities like this?
Knox's automated continuous monitoring platform watches your environment for newly disclosed vulnerabilities and compliance issues on an ongoing basis. For a CVE like CVE-2024-1708, that means exposure surfaces during continuous monitoring rather than waiting for an assessor to flag it at a periodic review.
How do I get FedRAMP authorized with Knox?
Knox runs a FedRAMP-as-a-Service platform. It gives SaaS vendors a pre-authorized cloud boundary on AWS, Azure, and GCP. Your application inherits 60-80% of the required security controls. You reach FedRAMP authorization in about 90 days for roughly 90% less than the traditional $3.5M path. Book a meeting and Knox will map your path to authorization.
CVE-2024-1708's remediation deadline of May 12, 2026 has passed. What happens now?
If CVE-2024-1708 remains unremediated, it is already a Plan of Action and Milestones (POA&M) item. A growing POA&M list is what turns a routine continuous-monitoring review into a difficult agency conversation. Closing the finding out and documenting why the deadline slipped is what keeps your authorization clean and your agency relationship intact.
Ready to achieve FedRAMP authorization in 90 days or less?
Schedule a meeting to discuss scope, parse readiness, and map your company’s accelerated path to FedRAMP authorization.
_Horizontal_RGB.png)
