Path traversal in ConnectWise ScreenConnect (CVE-2024-1708) — remote code execution, ransomware use confirmed

1ScreenConnect as an RMM tool

CVE-2024-1708 is a path-traversal vulnerability (CWE-22: improper limitation of a pathname) in ConnectWise ScreenConnect (an RMM — Remote Monitoring and Management — tool used by IT administrators and MSPs to remotely manage and support many endpoints). It is listed in CISA's KEV catalog, with ransomware use confirmed.

2Remote code execution as the outcome

Per NVD, an attacker could exploit it to execute remote code (RCE) or directly impact confidential data and critical systems. RMM tools are dangerous precisely because, by nature, they hold powerful privileges to remotely operate the many endpoints under their management. If a ScreenConnect server is compromised, an attacker can use it as a base to push malware to many managed endpoints at once.

Indeed, this vulnerability is known to have been widely exploited in ransomware attacks after disclosure (CISA also confirms ransomware use).

3How RMM amplifies an intrusion

RMM run at the perimeter or as SaaS can be a "lever" that amplifies damage in a supply-chain-like fashion.

4It does not end with one machine

An RMM tool is dangerous because, by its nature, it holds strong privileges to operate many endpoints remotely. How far a breach spreads differs from an ordinary server.

This vulnerability is known to have been widely used in ransomware attacks after disclosure. An RMM run at the perimeter or as SaaS becomes a lever that widens damage in a supply-chain fashion. Updating public servers first, investigating indicators of compromise such as suspicious connections and distributions, and checking managed endpoints are all recommended.