ConnectWise ScreenConnect Path‑Traversal (CVE‑2024‑1708) Enables Remote Code Execution
What It Is
ConnectWise ScreenConnect (now known as ConnectWise Control) contains a high‑severity path‑traversal flaw. An unauthenticated attacker can craft a request that traverses the file system, leading to arbitrary file read and, ultimately, remote code execution on the host running the ScreenConnect service.
Exploitability
The vulnerability is publicly disclosed with a CVSS v3.1 base score of 8.8 (High). Proof‑of‑concept details are available in the NVD advisory, indicating that exploitation requires only network access to the vulnerable service. No confirmed active exploitation reports have been published, but the attack vector is straightforward.
Affected Products
- Vendor: ConnectWise
- Product: ScreenConnect (ConnectWise Control) – all supported versions prior to the vendor‑released patch (see NVD advisory for exact version range).
Why It Matters for Compliance & Audit Readiness
Path‑traversal that leads to remote code execution directly challenges access‑control and system integrity controls required by frameworks such as NIST CSF, ISO 27001, and SOC 2. Demonstrating timely patch management and evidence of continuous control monitoring is essential for a defensible audit trail. Failure to remediate can be interpreted as a lapse in vendor‑management and change‑control processes, potentially impacting compliance attestations.
Recommended Actions
- Map the control: Align the vulnerability to the “Protect – Access Control” and “Detect – Continuous Monitoring” domains in your security framework.
- Patch promptly: Apply the vendor‑released security update for ScreenConnect to all affected endpoints.
- Validate: Conduct post‑patch verification scans and review logs for any anomalous file‑access attempts.
- Document: Record the remediation steps, patch version, and verification evidence in your change‑management system to support audit readiness.
- Monitor: Enable file‑integrity monitoring on the ScreenConnect host to detect any future unauthorized file access.
Source: https://nvd.nist.gov/vuln/detail/CVE-2024-1708