CVE-2024-1708

⚠️ high

Summary

ConnectWise ScreenConnect 23.9.7 and prior are affected by path-traversal vulnerability, which may allow an attacker the ability to execute remote code or directly impact confidential data or critical systems.

CVSS Score

8.4

High

EPSS Score

53.7

Exploit Probability

Published Date

2024-02-21

First Seen: 2026-01-05

📊 Relative Risk Intelligence

This CVE is High Risk - more severe than 79.9% of all 360,673 vulnerabilities in our database.

#72,538

Top 25% most severe

Severity Percentile

🎯 CISA SSVC Assessment Updated: Apr 28, 2026

🔍 Exploitation Status

Active

Exploits detected in the wild

⚙️ Automatable

Requires human interaction

💥 Technical Impact

Total

Complete system compromise possible

SSVC data provided by CISA

Last Modified 2026-04-28

Source NVD 🔗

CVSS Vector 3.1 CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:H/I:H/A:H

CWE IDs (Weakness Types)

CWE-22

📦 Affected Products 1

Vendor	Product	Status	Affected Versions
connectwise	screenconnect	Affected	< 23.9.8

🔗 References 4

https://www.connectwise.com/company/trust/security-b...

Vendor Advisory

https://www.huntress.com/blog/a-catastrophe-for-cont...

Exploit Third Party Advisory

https://www.cisa.gov/known-exploited-vulnerabilities...

US Government Resource Third Party Advisory

https://www.microsoft.com/en-us/security/blog/2026/0...

Technical Description

🔗 Related CVEs 6

CVE ID	Severity	CVSS	EPSS	Summary	Published
CVE-2026-84869	⛔ critical	9.9	0.7	A condition in the ScreenConnect client may allow files to be transferred and executed through an active remote session ...	2026-09-08
CVE-2026-11596	🔶 medium	4.7	0.2	In ScreenConnect™ versions prior to 26.2, input validation within the Host Pass creation functionality could allow an ...	2026-06-10
CVE-2025-14823	🔶 medium	5.3	0.0	In deployments using the ScreenConnect™ Certificate Signing Extension, encrypted configuration values including an Azu...	2025-12-18
CVE-2025-14265	⛔ critical	9.1	0.1	In versions of ScreenConnect™ prior to 25.8, server-side validation and integrity checks within the extension subsyste...	2025-12-11
CVE-2025-3935	⚠️ high	8.1	12.3	ScreenConnect versions 25.2.3 and earlier versions may be susceptible to a ViewState code injection attack. ASP.NET Web ...	2025-04-25
CVE-2024-1709	⛔ critical	10.0	94.3	ConnectWise ScreenConnect 23.9.7 and prior are affected by an Authentication Bypass Using an Alternate Path or Channel ...	2024-02-21

These CVEs affect the same products