ConnectWise ScreenConnect Path Traversal Vulnerability
ConnectWise ScreenConnect contains a path traversal vulnerability which could allow an attacker to execute remote code or directly impact confidential data and critical systems.
Quick answer
ConnectWise ScreenConnect should be reviewed and updated if it matches the affected versions. The recommended fix is to apply the vendor-supported patched version or the mitigation steps below, then retest the public website with Fixnx.
Who is affected
Affected versions
- Review vendor advisory for affected versions.
Fixed versions
- Apply the latest vendor-supported patched version.
How to fix it
CVE-2024-1708 affects ConnectWise ScreenConnect 23.9.7 and earlier and can allow path traversal that leads to remote code execution or direct impact to sensitive data. Update on-premise ScreenConnect servers to 23.9.8 or later immediately. Because ScreenConnect is a remote access platform, also review sessions, extensions, user accounts, and endpoint persistence after patching.
- Identify every on-premise ConnectWise ScreenConnect server and confirm the installed version.
- Upgrade affected servers to ScreenConnect 23.9.8 or later before restoring normal exposure.
- Restrict access to the ScreenConnect web portal and administration interface to trusted IP ranges where possible.
- Review administrator users, technician users, roles, extensions, toolbox items, and recently created sessions for unexpected changes.
- Rotate local admin credentials, ScreenConnect admin credentials, integration tokens, and API keys if the server was exposed while vulnerable.
- Inspect managed endpoints for suspicious ScreenConnect sessions, autoruns, remote commands, or dropped payloads.
- If compromise is suspected, isolate the ScreenConnect server and rebuild it from a trusted backup after collecting evidence.
Scan now. Google sign-in is only needed to unlock fix guidance.
Verify the fix
- Confirm the ScreenConnect version is 23.9.8 or later.
- Verify public access is restricted and administrative access requires strong authentication.
- Confirm no unexpected extensions, users, sessions, or toolbox files remain.
- Review ScreenConnect audit logs and endpoint telemetry for suspicious activity.
- Run a Fixnx scan and external port review after patching and access restrictions.
Related categories
Trusted references
FAQ
What is affected by CVE-2024-1708?
ConnectWise ScreenConnect should be checked against the vendor advisory and trusted references linked on this page.
What should I fix first?
Start with internet-facing sites, admin panels, login flows, plugins, themes, modules, packages, and systems that process user-controlled input or sensitive data.
How do I confirm the fix worked?
Apply the patched version or mitigation, clear caches where relevant, retest the affected workflow, and run a new Fixnx scan to verify public website exposure signals.
Why can this risk appear in multiple categories?
A vulnerability can belong to more than one platform or ecosystem. Fixnx keeps one canonical risk page while also listing it in every relevant category.