CVE-2024-1708 - PatchNow

📋 Vulnerability Details

Data Source: CIRCL

Confidence: HIGH

Exploitation Method: DIRECT_NETWORK

CVE Published: 2024-02-21

Added to CISA KEV: 2026-04-28 797 DAYS BETWEEN CVE AND KEV

🎯 Recommendations:

CRITICAL: Check for indicators of compromise - this vulnerability is in CISA KEV indicating active exploitation in the wild. Review logs, check for unauthorized access, verify system integrity
Immediately update to ScreenConnect version 23.9.8 or later
Implement network segmentation to limit access to ScreenConnect servers
Monitor for unusual file access patterns and suspicious remote connections
CRITICAL patch priority - exploit code is available and actively used by threat actors

🔍 Web Intelligence (Kagi · 2026-06-04)

CVE-2024-1708 is a high-severity path traversal vulnerability (specifically a "Zip Slip" flaw) affecting ConnectWise ScreenConnect (now ConnectWise Access) ^[1]. It is widely recognized as part of the "SlashAndGrab" exploit chain, which also involved an authentication bypass vulnerability (CVE-2024-1709) ^[3].

Key Details

Feature	Description
Vulnerability Type	Path Traversal (CWE-22) / "Zip Slip" ^[1]
Affected Versions	ConnectWise ScreenConnect 23.9.7 and prior ^[6]
Impact	Remote Code Execution (RCE), unauthorized file/directory access, and potential compromise of critical systems ^[5]
Patch Status	Fixed in version 23.9.8 ^[3]

Exploitation and Threat Landscape

Active Exploitation: The vulnerability was subject to widespread, active exploitation in the wild shortly after its disclosure in February 2024 ^[2] ^[4].
Attack Method: The flaw exists in the `ZipDirectory.ExtractToDirectory` method used for installing extensions. Attackers could upload a malicious `.zip` archive containing files with "dot-dot-slash" (`../`) sequences, allowing them to write files outside the intended directory ^[1].
Requirements: While the vulnerability itself is a path traversal, it was frequently used in conjunction with CVE-2024-1709 (an authentication bypass) to achieve full RCE on the instance ^[4].
Usage in Campaigns: The vulnerability was heavily leveraged by threat actors for post-exploitation activities, including the deployment of ransomware and other malicious payloads, following the initial compromise of ScreenConnect instances ^[2].
Proof-of-Concept: Security researchers, including those at Huntress, successfully recreated proof-of-concept exploits shortly after the vulnerability was disclosed to demonstrate its impact ^[3].

Sources