CVE-2024-1709
קריטית 10.0 מנוצלת בשטח (KEV) בשימוש בכופרה
ניצול פעיל מאומת — קטלוג CISA KEV
- שם
- ConnectWise ScreenConnect Authentication Bypass Vulnerability
- נוסף לקטלוג
- יעד טיפול (פדרלי)
- פעולה נדרשת
- Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.
תיאור (מקור, אנגלית)
ConnectWise ScreenConnect 23.9.7 and prior are affected by an Authentication Bypass Using an Alternate Path or Channel vulnerability, which may allow an attacker direct access to confidential information or critical systems.
מדדים
- CVSS 3.1
-
10.0 (CRITICAL)
מקור הציון: NVD
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H - EPSS — סבירות ניצול
- 100% (אחוזון 100) נכון ל-25/7/2026
- CWE
- CWE-288
מוצרים מושפעים
connectwise: screenconnect
קישורים
- https://www.connectwise.com/company/trust/security-bulletins/connectwise-scree… Vendor Advisory
- https://www.connectwise.com/company/trust/security-bulletins/connectwise-scree… Vendor Advisory
- https://github.com/rapid7/metasploit-framework/pull/18870 Issue TrackingPatchThird Party Advisory
- https://github.com/rapid7/metasploit-framework/pull/18870 Issue TrackingPatchThird Party Advisory
- https://github.com/watchtowrlabs/connectwise-screenconnect_auth-bypass-add-use… ExploitThird Party Advisory
- https://www.huntress.com/blog/a-catastrophe-for-control-understanding-the-scre… ExploitThird Party Advisory
- https://www.huntress.com/blog/detection-guidance-for-connectwise-cwe-288-2 ExploitThird Party Advisory
- https://github.com/watchtowrlabs/connectwise-screenconnect_auth-bypass-add-use… ExploitThird Party Advisory
- https://www.huntress.com/blog/a-catastrophe-for-control-understanding-the-scre… ExploitThird Party Advisory
- https://www.huntress.com/blog/detection-guidance-for-connectwise-cwe-288-2 ExploitThird Party Advisory