Path traversal in ConnectWise ScreenConnect (CVE-2024-1708) — remote code execution, ransomware use confirmed

CVE-2024-1708 is a path-traversal vulnerability (CWE-22: improper limitation of a pathname) in ConnectWise ScreenConnect (an RMM — Remote Monitoring and Management — tool used by IT administrators and MSPs to remotely manage and support many endpoints). It is listed in CISA's KEV catalog, with ransomware use confirmed.

Per NVD, an attacker could exploit it to execute remote code (RCE) or directly impact confidential data and critical systems. RMM tools are dangerous precisely because, by nature, they hold powerful privileges to remotely operate the many endpoints under their management. If a ScreenConnect server is compromised, an attacker can use it as a base to push malware to many managed endpoints at once. Indeed, this vulnerability is known to have been widely exploited in ransomware attacks after disclosure (CISA also confirms ransomware use).

RMM run at the perimeter or as SaaS can be a "lever" that amplifies damage in a supply-chain-like fashion.

Key response: update to a fixed version per ConnectWise's official instructions (internet-exposed servers first). For cloud use, follow BOD 22-01. Investigating signs of compromise (suspicious connections or deployments) and checking managed endpoints are also recommended. The federal civilian remediation deadline was May 12, 2026.