A critical authentication bypass vulnerability in ConnectWise ScreenConnect (CVE-2024-1709) is being actively exploited in the wild. The flaw allows attackers to gain unauthorized administrative access and execute remote code on affected systems.
A severe authentication bypass vulnerability (CVE-2024-1709) affecting ConnectWise ScreenConnect, formerly known as ConnectWise Control, has emerged as a critical security threat with confirmed active exploitation. The vulnerability allows attackers to bypass authentication mechanisms and gain unauthorized administrative access to affected ScreenConnect instances. The flaw affects all on-premises versions prior to 23.9.8 and cloud instances that haven't been automatically updated. Successful exploitation enables attackers to execute arbitrary code with SYSTEM/root privileges on both the ScreenConnect server and connected client endpoints. Multiple threat actors are actively scanning for and exploiting vulnerable instances, with some attacks involving ransomware deployment and data theft.
ConnectWise ScreenConnect, a widely-used remote access and support solution, is affected by a critical authentication bypass vulnerability (CVE-2024-1709) that allows attackers to gain unauthorized administrative access to affected instances. The vulnerability was disclosed on February 19, 2024, and has since been observed being actively exploited by multiple threat actors.
The authentication bypass vulnerability exists in the web interface of ScreenConnect/ConnectWise Control servers. It allows unauthenticated attackers to:
The vulnerability stems from an improper access control implementation in the web interface. Attackers can exploit this flaw by sending specially crafted requests to bypass authentication checks and gain administrative privileges. Once authenticated, attackers can:
Multiple threat actors are actively scanning for and exploiting vulnerable instances. Observed attack patterns include:
The potential impact of successful exploitation is severe:
Multiple malicious packages discovered in PyPI and npm repositories executing credential theft and crypto mining payloads. Supply chain attacks leverage typosquatting and dependency confusion techniques to compromise development environments.
Critical authentication bypass and command injection vulnerabilities in Ivanti Connect Secure VPN are being actively exploited in the wild. Threat actors are deploying web shells and maintaining persistence in compromised environments.
Chinese state-sponsored threat actor Salt Typhoon (aka Bronze Silhouette) conducts persistent intrusion campaign against US telecommunications providers. The group employs sophisticated living-off-the-land techniques and custom malware to maintain long-term access to critical infrastructure.
Large-scale ransomware campaign exploiting VMware ESXi vulnerabilities to encrypt virtual machines and disrupt business operations. Attackers leverage CVE-2021-21974 to compromise unpatched systems globally.