Authentication Bypass in ConnectWise ScreenConnect (CVE‑2024‑1709) Enables Admin‑Level Account Creation
What It Is — ConnectWise ScreenConnect (now ConnectWise Control) contains an authentication bypass flaw that lets an attacker with network‑level access to the management interface create a new administrator‑level account without valid credentials.
Exploitability — The vulnerability is publicly disclosed (CVE‑2024‑1709) and has a CVSS v3.1 base score of 9.8 (Critical). No public exploit code has been released, but the attack requires only network reach to the management console, making it highly actionable for internal threat actors or compromised network segments.
Affected Products — ConnectWise ScreenConnect / ConnectWise Control (all versions prior to the vendor‑released patch on 2024‑09‑10).
Why It Matters for Trust & Control Assurance
- Privileged‑account governance – An unauthorized admin account subverts any existing least‑privilege model, eroding the assurance that only vetted identities can perform high‑impact actions.
- Continuous monitoring – Detecting the creation of rogue admin accounts requires real‑time log collection and correlation, a core element of a defensible audit trail.
- Evidence of due diligence – Demonstrating that you enforce strict access‑control policies and can prove it to auditors is increasingly a contract prerequisite for SaaS buyers.
Recommended Actions
- Apply ConnectWise’s security patch immediately.
- Restrict network access to the ScreenConnect management interface (e.g., VPN‑only, IP‑allowlists).
- Enable multi‑factor authentication for all admin accounts.
- Deploy continuous monitoring of privileged‑account creation events and retain logs for at least 90 days.
- Conduct a post‑patch review of existing admin accounts to ensure no unauthorized accounts remain.
Source: CISA KEV – CVE‑2024‑1709