KEV catalog · CISA Known Exploited Vulnerabilities
CVE-2024-1708
8.4
3-Day Required
PoC Available
KEV
Active Exploitation
Details
VulnerabilityConnectWise ScreenConnect Path Traversal Vulnerability
VendorConnectWise
ProductScreenConnect
Date added2026-04-28
Due date2026-05-12
CISA catalogView on CISA KEV catalog
Required actionApply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.
CWECWE-22
CVSS vectorCVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:H/I:H/A:H
Descriptions
KEV: ConnectWise ScreenConnect contains a path traversal vulnerability which could allow an attacker to execute remote code or directly impact confidential data and critical systems.
NVD: ConnectWise ScreenConnect 23.9.7 and prior are affected by path-traversal vulnerability, which may allow an attacker the ability to execute remote code or directly impact confidential data or critical systems.
Compliance SSVC + BOD 26-04
Automatableno
Technical impacttotal
Exploitation statusactive
3-day qualifyingYes
Public timeline3 days + forensic
Non-public timeline14 days
Forensic (public)Required
Forensic (non-public)Not required
Research metadata
Last researched2026-08-26 14:44 UTC
Wall time45.0s
Searches5
Component defaultyes
Sources
https://nvd.nist.gov/vuln/detail/CVE-2024-1708
https://www.connectwise.com/company/trust/security-bulletins/connectwise-screenconnect-23.9.8
https://www.huntress.com/threat-library/vulnerabilities/cve-2024-1708
https://attackerkb.com/topics/APXUXGRjh0/cve-2024-1708
https://www.huntress.com/blog/a-catastrophe-for-control-understanding-the-screenconnect-authentication-bypass
https://unit42.paloaltonetworks.com/connectwise-threat-brief-cve-2024-1708-cve-2024-1709/
https://github.com/rapid7/metasploit-framework/blob/master/modules/exploits/multi/http/connectwise_screenconnect_rce_cve_2024_1709.rb
https://github.com/watchtowrlabs/connectwise-screenconnect_auth-bypass-add-user-poc
https://github.com/W01fh4cker/ScreenConnect-AuthBypass-RCE
https://www.trendmicro.com/en/research/24/b/threat-actor-groups-including-black-basta-are-exploiting-recent-.html
https://blackpointcyber.com/blog/breaking-through-the-screen/
https://www.picussecurity.com/resource/blog/cve-2024-1709-cve-2024-1708-connectwise-screenconnect-vulnerability-exploitations
https://censys.com/blog/connectwise-screenconnect-cve-2024-1709-cve-2024-1708/
https://github.com/Teexo/ScreenConnect-CVE-2024-1709-Exploit
https://www.microsoft.com/en-us/security/blog/2026/04/06/storm-1175-focuses-gaze-on-vulnerable-web-facing-assets-in-high-tempo-medusa-ransomware-operations/
https://www.connectwise.com/company/trust/security-bulletins/connectwise-screenconnect-23.9.8
https://www.huntress.com/threat-library/vulnerabilities/cve-2024-1708
https://attackerkb.com/topics/APXUXGRjh0/cve-2024-1708
https://www.huntress.com/blog/a-catastrophe-for-control-understanding-the-screenconnect-authentication-bypass
https://unit42.paloaltonetworks.com/connectwise-threat-brief-cve-2024-1708-cve-2024-1709/
https://github.com/rapid7/metasploit-framework/blob/master/modules/exploits/multi/http/connectwise_screenconnect_rce_cve_2024_1709.rb
https://github.com/watchtowrlabs/connectwise-screenconnect_auth-bypass-add-user-poc
https://github.com/W01fh4cker/ScreenConnect-AuthBypass-RCE
https://www.trendmicro.com/en/research/24/b/threat-actor-groups-including-black-basta-are-exploiting-recent-.html
https://blackpointcyber.com/blog/breaking-through-the-screen/
https://www.picussecurity.com/resource/blog/cve-2024-1709-cve-2024-1708-connectwise-screenconnect-vulnerability-exploitations
https://censys.com/blog/connectwise-screenconnect-cve-2024-1709-cve-2024-1708/
https://github.com/Teexo/ScreenConnect-CVE-2024-1709-Exploit
https://www.microsoft.com/en-us/security/blog/2026/04/06/storm-1175-focuses-gaze-on-vulnerable-web-facing-assets-in-high-tempo-medusa-ransomware-operations/
QC notes
warn component_extraction: Component 'ScreenConnect.Core.dll - ScreenConnect.ZipFile.ExtractAllEntries function (Zip Slip in extension installation via /Services/ExtensionService.ashx/InstallExtension)' matches or contains product name 'ScreenConnect' — no specific component identified
Hunting hypothesis agent
Hunt access logs for POST /Services/ExtensionService.ashx/InstallExtension followed by new .ashx requests under /App_Extensions — SlashAndGrab CVE-2024-1708 chains auth bypass with Zip Slip traversal in extension ZIPs to drop webshells.
Research details
ComponentScreenConnect.Core.dll - ScreenConnect.ZipFile.ExtractAllEntries function (Zip Slip in extension installation via /Services/ExtensionService.ashx/InstallExtension)
PreconditionsAuthenticated administrator access to ScreenConnect web interface (typically achieved by chaining with CVE-2024-1709 authentication bypass with CVSS 10.0); Ability to upload a malicious extension ZIP file via HTTP POST to /Services/ExtensionService.ashx/InstallExtension; ScreenConnect version 23.9.7 or earlier; Server running on default port 8040 agent
DeliveryHTTP POST request to /Services/ExtensionService.ashx/InstallExtension with a crafted ZIP file containing directory traversal sequences (../) in filenames; the Metasploit module chains CVE-2024-1709 (SetupWizard.aspx auth bypass) to create an admin account, uploads an extension ZIP with a manifest.xml and a ../<payload>.ashx file that lands in App_Extensions, then triggers execution via POST to /App_Extensions/<payload>.ashx
Public PoCyes
PoC URLs
https://github.com/rapid7/metasploit-framework/blob/master/modules/exploits/multi/http/connectwise_screenconnect_rce_cve_2024_1709.rb
https://github.com/watchtowrlabs/connectwise-screenconnect_auth-bypass-add-user-poc
https://github.com/W01fh4cker/ScreenConnect-AuthBypass-RCE
https://github.com/Teexo/ScreenConnect-CVE-2024-1709-Exploit Third-party repos; verify before use.
https://github.com/watchtowrlabs/connectwise-screenconnect_auth-bypass-add-user-poc
https://github.com/W01fh4cker/ScreenConnect-AuthBypass-RCE
https://github.com/Teexo/ScreenConnect-CVE-2024-1709-Exploit Third-party repos; verify before use.
Advisoryhttps://www.connectwise.com/company/trust/security-bulletins/connectwise-screenconnect-23.9.8
Exploit notesCVSS attack complexity: LOW. Trivially exploitable once admin access is obtained (typically via CVE-2024-1709 authentication bypass, CVSS 10.0). Zip Slip vulnerability in ZIP file extraction during extension install — the ExtractAllEntries function honors double-dot path segments (../). Metasploit module and multiple public PoCs available. Widely exploited in ransomware campaigns (Black Basta, Bl00dy, Storm-1175/Medusa). User interaction requirement in CVSS scoring disputed by exploit authors (no user interaction needed after authentication bypass). The vulnerability is named the 'SlashAndGrab' exploit chain when paired with CVE-2024-1709.
SummaryCVE-2024-1708 is a Zip Slip path traversal vulnerability (CWE-22, CVSS 8.4) in ConnectWise ScreenConnect 23.9.7 and earlier, residing in the ScreenConnect.Core.dll ZipFile.ExtractAllEntries function. When an authenticated administrator installs a malicious extension ZIP via HTTP POST to /Services/ExtensionService.ashx/InstallExtension, directory traversal sequences (../) in filenames allow writing ASPX/ASHX webshells to the web-accessible App_Extensions root. When chained with CVE-2024-1709 (authentication bypass, CVSS 10.0), unauthenticated attackers can achieve full RCE. Actively exploited by ransomware groups including Black Basta, Bl00dy, and Storm-1175/Medusa. Multiple public PoCs and a Metasploit module are widely available.
Tia coverage
First reported2026-04-29
First exploit report2026-04-29
Exploit report → KEV1 days after the listing
When Tia's reporting first covered this CVE and whether a report claimed exploitation before the KEV listing. Lead-time deltas are measured from the exploitation report only — plain coverage is not exploitation intel. See the story links under Mentioned in for coverage detail.
Mentioned in
cisa-adds-connectwise-screenconnect-cve-2024-1708-to-known-explo
Record schema v1.0. Enrichment is research-grade, not a substitute for analyst review.