.webp)
ConnectWise has released a security update for its ScreenConnect software. Two vulnerabilities are associated with the patch, CVE-2024-1709 (CVSSv3: 10.0) and CVE-2024-1708 (CVSSv3: 8.4) these vulnerabilities can result in an attacker having direct access to confidential information or critical systems or causing remote code execution. These vulnerabilities are currently being utilized by threat actors, the vendor has provided indicators of compromise.
These vulnerabilities are high severity and are under active exploitation. They will require an emergency patching cadence if using the on-premises version of the ScreenConnect software.
These vulnerabilities have been researched by Team Huntress and have developed proof of concept code which could be easy to replicate and shows that the vulnerabilities overall are also quite simple to exploit.
CVE-2024-1709 is considered an authentication bypass using an alternate path or channel while CVE-2024-1708 is an improper limitation of a pathname to a restricted directory (“path traversal”). They are both used in conjunction for the attack.
If you are a user of this application this means that your organization should be advised to patch this vulnerability as soon as possible.
A patch has been made available, ScreenConnect version 23.9.8 and later will remediate the vulnerabilities.
Indicators of compromise were discovered by the vendor. The follow IP addresses were being used by threat actors:
It is advised to check your environment for any activity from these IPs and block them.
Exploitation of these vulnerabilities would be devastating and has a high likelihood of occurring. Incident response costs, disaster recovery, and business inefficiencies as a result of an exploit would be devastating to the bottom line.
Patch: Follow vendor recommendations and patch on an emergency patching cadence.
Monitor: Perform network monitoring to ensure that this vulnerability has not been exploited and prevent exploitation by blocking the indicators of compromise and ensuring that only legitimate network traffic is running through a system running the ScreenProtect software.
Associated Bulletins
https://www.connectwise.com/company/trust/security-bulletins/connectwise-screenconnect-23.9.8
On this episode of the CyberWatch podcast, there are updates to software across the application and OS spectrum. New malicious campaigns are threatening victims of all sizes, and researchers have performed dissections on malware to give defenders new clues about just what it is they're fighting. All this today, in CyberWatch.
As we conclude our 'ransomware readiness week' of this Cybersecurity Awareness Month, it's time to take a critical look at your organization's defenses. Ransomware attacks are becoming more sophisticated, and no business is immune. In our latest article, we explore essential strategies to bolster your ransomware preparedness. Don't miss this vital information to help protect your business from emerging threats.
Ethical hacking has become an essential response to an IT industry kept on its toes by a spectrum of bad actors with malicious intent. This article introduces two prominent methodologies that help the good guys fight back: penetration testing (pen-testing) and red teaming. Learn more here.
Host Geoff Hancock was joined by guests Mike Rush, Director of Threat Intelligence at Access Point Consulting; and Evie Manning, Senior Director of Threat Hunting and Intelligence at Access Point Consulting. Together, they talked about cyber threat intelligence and the applications that can make it work for small and medium-sized businesses.
