VDB
BDU%3A2024-01532
BDU%3A2024-01532
PUBLISHED
CVSS 8.399999618530273 HIGH
Уязвимость программного средства организации удалённого доступа ConnectWise ScreenConnect, связанная с неверным ограничением имени пути к каталогу с ограниченным доступом, позволяющая нарушителю выполнить произвольный код
Risk Scores
CVSS 3.1
8.399999618530273
CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:H/I:H/A:H
Affected Products
| Vendor | Product | Versions |
|---|---|---|
| ConnectWise | ScreenConnect | 0 |
| ConnectWise, LLC. | ConnectWise ScreenConnect |
Timeline
- Feb 21, 2024 PoC Published
- Feb 21, 2024 CVE Published
- Feb 21, 2024 PoC Published
- Feb 21, 2024 PoC Published
- Feb 22, 2024 PoC Published
- Feb 22, 2024 PoC Published
- Feb 22, 2024 PoC Published
- Feb 22, 2024 PoC Published
- Feb 22, 2024 PoC Published
- Feb 22, 2024 PoC Published
- Feb 23, 2024 PoC Published
- Feb 23, 2024 PoC Published
References
- https://www.huntress.com/blog/a-catastrophe-for-control-understanding-the-screenconnect-authentication-bypass url
- https://www.cloudsek.com/blog/an-insider-look-at-the-irgc-linked-apt35-operations url
- https://www.microsoft.com/en-us/security/blog/2026/04/06/storm-1175-focuses-gaze-on-vulnerable-web-facing-assets-in-high-tempo-medusa-ransomware-operations/ third-party-advisory
- https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2024-1708 url
- https://www.connectwise.com/company/trust/security-bulletins/connectwise-screenconnect-23.9.8 url