Improper limitation of a pathname to a restricted directory (“path traversal”) (CVE-2024-1708)

What is affected, what to do

ConnectWise ScreenConnect 23.9.7 and prior are affected by path-traversal vulnerability, which may allow an attacker the ability to execute remote code or directly impact confidential data or critical systems.

The vulnerability is being actively exploited; treat it as a priority. CISA lists it as used in ransomware campaigns. Update screenconnect to version 23.9.8. Immediate actions, mitigation and detection rules are in the runbook below.

Affected

• ConnectWise ScreenConnect lte *..23.9.7

Not sure whether and how you are affected? Ask a question about this vulnerability

Metrics

Response and mitigation

1. 01

   Runbook step 1

   Immediate response (0-24 h)

   • Upgrade every on-premises instance to ScreenConnect 23.9.8 or later now. Versions 23.9.7 and earlier are affected. Cloud-hosted instances (screenconnect.com/hostedrmm.com) are patched centrally by the vendor, but confirm the running version in the admin console anyway. For licensing/maintenance specifics: patch available from the vendor — check the vendor advisory for details.
   • Pull unpatched servers off the internet. Block the web interface (default 8040/TCP, or 443 behind a reverse proxy) and the relay port (default 8041/TCP) at the perimeter until the upgrade is done. ScreenConnect is a remote-access tool — a compromised server means hands-on access to every managed endpoint.
   • Assume chaining with CVE-2024-1709. CVE-2024-1708 formally requires admin privileges, but in practice it is paired with the CVE-2024-1709 authentication bypass (SetupWizard.aspx). Both are fixed in 23.9.8 — treat any exposed, unpatched server as potentially compromised.
   • Compromise check before returning to service: review App_Data\User.xml for unknown admin accounts, inspect App_Extensions\ for foreign .aspx/.ashx/.dll files, reset all ScreenConnect user passwords and enforce MFA.
   • If you find indicators: open an incident under your reporting process (NIS2: early warning within 24 h to the national CSIRT/authority), image the server, and sweep all endpoints reachable from it for newly installed remote-access agents, persistence and ransomware staging.
2. 02

   Runbook step 2

   Mitigation layers

   • Network segmentation: expose the ScreenConnect web UI only via VPN/ZTNA or an admin IP allowlist; restrict the relay port to known client network ranges.
   • Reverse proxy/WAF: hard-block requests to /SetupWizard.aspx (including trailing-path variants like /SetupWizard.aspx/…) once initial setup is complete. Drop extension uploads (ZIP archives containing ../ or ..\ in entry names) at the proxy.
   • Server endpoint hardening: tighten ACLs so the ScreenConnect service account cannot write to the web root beyond what is required; use WDAC/AppLocker to stop cmd.exe/powershell.exe launching as children of ScreenConnect.Service.exe.
   • IAM/least privilege: minimise ScreenConnect admins, mandate MFA, replace local accounts with SSO/IdP integration, and restrict extension installation to a dedicated admin role.
   • Client side: on managed endpoints, allow the ScreenConnect client to connect only to your own relay host; block unknown ScreenConnect instances (foreign relay hosts) via proxy/DNS filtering — attackers frequently deploy their own instances for persistence.
3. 03

   Runbook step 3

   Detection rules

   • Sysmon EID 11 / EDR file events: creation of .aspx, .ashx or .dll under …\ScreenConnect\App_Extensions\ outside planned maintenance. Sigma shape: TargetFilename|contains: '\ScreenConnect\App_Extensions\' and TargetFilename|endswith: ['.aspx','.ashx'].
   • Process ancestry (Sysmon EID 1 / Security 4688): ScreenConnect.Service.exe spawning cmd.exe/powershell.exe/csc.exe on the server. KQL: DeviceProcessEvents | where InitiatingProcessFileName =~ "ScreenConnect.Service.exe" | where FileName in~ ("cmd.exe","powershell.exe","pwsh.exe","rundll32.exe"). Note: ScreenConnect.ClientService.exe on endpoints launches shells legitimately — baseline before alerting there.
   • Web/proxy access logs: hits on SetupWizard.aspx after initial setup, especially with an appended path segment, followed by extension-upload POSTs from unfamiliar source IPs. SPL: index=proxy uri_path="*SetupWizard.aspx*" | stats count by src_ip, uri_path.
   • File integrity: changes to App_Data\User.xml (Sysmon EID 11 or FIM) and newly created admin accounts, correlated with logins from unusual geolocations.
   • Downstream endpoint activity: bulk remote commands or tool pushes through ScreenConnect sessions, installation of additional RMM agents, Defender being disabled (Event ID 5001) — classic precursors to ransomware deployment.

Detection rules

No NEOSEC detection rule is available for this vulnerability yet.

Classification under NIS2 and CRA

Rule-based classification from exploitation status and severity. It does not replace a case-by-case assessment.

NIS2

NIS2 is EU Directive (EU) 2022/2555 to raise the level of cybersecurity across the Union. It substantially broadens obligations compared with the first NIS directive: more sectors, mandatory risk management, staged reporting duties and personal accountability of senior management.

Read in glossary

Actively exploited: treat the vulnerability as a priority in vulnerability handling under Art. 21(2)(e) NIS2. If it is exploited in your environment, check the reporting obligation under Art. 23 (early warning within 24 hours).

CRA

The CRA is EU Regulation (EU) 2024/2847 setting horizontal cybersecurity requirements for „products with digital elements“ — from industrial controllers and software to connected consumer devices. For the first time manufacturers must ensure security across the entire product lifecycle, handle vulnerabilities and provide security updates.

Read in glossary

Since 11.09.2026, manufacturers of affected products with digital elements must report actively exploited vulnerabilities under Art. 14 CRA, with an early warning within 24 hours via ENISA's single reporting platform.

ISO/IEC 27001

ISO/IEC 27001 is the internationally leading standard for an information security management system (ISMS). It describes a risk-based, process-oriented framework to systematically plan, implement, review and improve information security.

Read in glossary

Control A.8.8, management of technical vulnerabilities: assess relevance to your systems, plan remediation and keep evidence.

Description

ConnectWise ScreenConnect 23.9.7 and prior are affected by path-traversal vulnerability, which may allow an attacker the ability to execute remote code or directly impact confidential data or critical systems.

Source: pwn.watch, NVD (NIST), CISA KEV Catalog, cvelistv5, ENISA EUVD, CVE.org (MITRE)

Vendors and products

• ConnectWise ConnectWise ScreenConnect

Weakness classes (CWE)

• CWE-22Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')

  Base

  The product uses external input to construct a pathname that is intended to identify a file or directory that is located underneath a restricted parent directory, but the product does not properly neutralize special elements within the pathname that can cause the pathname to resolve to a location that is outside of the restricted directory.

  Entry at MITRE CWE-22

References & sources

• connectwise.comConnectWise ScreenConnect 23.9.8 security bulletineuvd, Vendor advisory, pwn-watch
• huntress.comblog/a-catastrophe-for-control-understanding-the-screenconnect-…euvd, Exploit, Third-party advisory
• microsoft.comen-us/security/blog/2026/04/06/storm-1175-focuses-gaze-on-vulne…Third-party advisory, Technical description
• cisa.govknown-exploited-vulnerabilities-catalog?field_cve=CVE-2024-1708government-resource, Third-party advisory, US government resource
• pwn.watchpwn.watch: ConnectWise ScreenConnect auth bypass mass-exploitedpwn-watch
• NVD (NIST)NVD: CVE-2024-1709pwn-watch
• NVD (NIST)NVD: CVE-2024-1708pwn-watch
• cisa.govCISA Known Exploited Vulnerabilities Catalogpwn-watch