connectwise-screenconnect_auth-bypass-add-user-poc

CVE-2024-1708 y CVE-2024-1709 Una prueba de concepto desarrollada por @watchTowr para explotar una omisión de autenticación y añadir un nuevo usuario administrativo en ConnectWise ScreenConnect. Este es el primer paso en una cadena trivial de Ejecución Remota de Comandos. Sigue al equipo de...

ScreenConnect-AuthBypass-RCE

如何使用 我正在使用 Python3.9 root@kitploit: pip install requests python check.py python batchAdduser.py root@kitploit: python ScreenConnect-AuthBypass-RCE.py -h usage: ScreenConnect-AuthBypass-RCE.py -h -u USERNAME -p PASSWORD -t TARGET -d DOMAIN --proxy PROXY CVE-2024-1708 && CVE-2024-1709 -- RCE!!!...

ScreenConnect-UserEnum

ScreenConnect 用户枚举 ConnectWise（也称为ScreenConnect）存在一个用户枚举漏洞。这是一个针对该漏洞的用户枚举工具。 CVE-2019-16516 受影响版本 = 19.2.24707 ??? 不确定他们是否在更高版本中修复了 https://docs.connectwise.com/ConnectWiseControlDocumentation/ConnectWiseControlreleasenotes/ReleasenotesarchiveConnectWiseControl2019.5 root@kitploit: Tried on...

cve-2024-1708-connectwise_rce_reproduction

CVE-2024-1708 / CVE-2024-1709 — ConnectWise ScreenConnect 認証バイパスおよびリモートコード実行 CVSS スコア: 8.4 CVE-2024-1708 – 10.0 CVE-2024-1709 CWE: CWE-22（パストラバーサル）、CWE-288（代替パスを使用した認証バイパス） 影響を受けるソフトウェア: ConnectWise ScreenConnect（旧 ScreenConnect）≤ 23.9.7 発見・報告: 2024年2月 実環境での悪用: LockBit、Black Basta、Bl00dy...

CVE-2024-1709-ConnectWise-ScreenConnect-Authentication-Bypass

ConnectWise ScreenConnect: 認証バイパス はじめに このプロジェクトは、ConnectWise ScreenConnect の認証バイパス脆弱性を悪用することを目的としています。この脆弱性を実証するスクリプトを提供します。このスクリプトを使用する前に、必要な権限を持っていることを確認してください。 使用方法 root@kitploit: python exploit.py options オプション: --username: 追加するユーザー名 必須。 --password: 追加するパスワード 必須。 --urls: URL を含むファイルへのパス。 --ur...

CVE-2026-84869

A condition in the ScreenConnect client may allow files to be transferred and executed through an active remote session without authorization or Host confirmation in certain circumstances. ScreenConnect servers are not impacted...

CVE-2026-84869 ScreenConnect Client: Guest-to-Host File Execution via File-Transfer Actions

A condition in the ScreenConnect client may allow files to be transferred and executed through an active remote session without authorization or Host confirmation in certain circumstances. ScreenConnect servers are not impacted...

EUVD-2026-74053

A condition in the ScreenConnect client may allow files to be transferred and executed through an active remote session without authorization or Host confirmation in certain circumstances. ScreenConnect servers are not impacted...

CVE-2026-84869 ScreenConnect Client: Guest-to-Host File Execution via File-Transfer Actions

A condition in the ScreenConnect client may allow files to be transferred and executed through an active remote session without authorization or Host confirmation in certain circumstances. ScreenConnect servers are not impacted...

CVE-2026-84869

CVE-2026-84869 affects the ScreenConnect client (by ConnectWise). A condition in the client allows a guest to transfer and execute files on the host through an active remote session without proper authorization or Host confirmation, as described in the CVELIST record title. ScreenConnect servers ...

VulnCheck KEV: CVE-2026-84869

A condition in the ScreenConnect client may allow files to be transferred and executed through an active remote session without authorization or Host confirmation in certain circumstances. ScreenConnect servers are not impacted...

PT-2026-88316

CVE-2026-84869 CVSS 9.9: a flaw in the ScreenConnect client lets files be transferred and executed during an active remote session — no authorization or host confirmation required. ScreenConnect servers are not impacted. ConnectWise patched it five days after their initial warning. Added to CISA'...

Rogue ScreenConnect Clients Spread Four-Stage VBScript Chain to Newly Connected Hosts

Cybersecurity researchers have disclosed details of worm-like activity that abuses ConnectWise ScreenConnect to distribute a malicious Visual Basic Script VBScript payload to newly connected systems. According to Huntress, three unrelated incidents have been found to use diverse initial access...

ConnectWise ScreenConnect <= 23.9.7 - Path Traversal

ConnectWise ScreenConnect 23.9.7 and prior contain a path traversal caused by improper handling of user input, letting attackers execute remote code or access confidential data, exploit requires network access. id: CVE-2024-1708 info: name: ConnectWise ScreenConnect = 23.9.7 - Path Traversal...

ConnectWise ScreenConnect 23.9.7 - Authentication Bypass

ConnectWise ScreenConnect 23.9.7 and prior are affected by an Authentication Bypass Using an Alternate Path or Channel vulnerability, which may allow an attacker direct access to confidential information or critical systems. id: CVE-2024-1709 info: name: ConnectWise ScreenConnect 23.9.7 -...

Exploit for Authentication Bypass Using an Alternate Path or Channel in Connectwise Screenconnect

CVE-2024-1709 — ScreenConnect exploit chain Full exploit chai...

Fake Adobe and Zoom Updates Install ScreenConnect for Persistent Remote Access

Cybersecurity researchers have disclosed details of an active, multi-wave campaign that employs social engineering lures themed around Adobe and Zoom software updates, business document reviews, and system maintenance utilities to stealthily deploy Remote Monitoring and Management RMM programs li...

Operation BlueDash Deploys Level RMM and ScreenConnect via Fake Teams Update

Cybersecurity researchers have flagged a Microsoft Teams-themed phishing campaign that employs "secure document" lures to deliver legitimate remote monitoring and management RMM tools. "The victim was directed through compromised web infrastructure to a counterfeit Microsoft Store page claiming...

Exploit for Path Traversal in Connectwise Screenconnect

CVE-2024-1708 / CVE-2024-1709 — ConnectWise ScreenConnect Auth...

The SOC Files: ScreenConnect masked as freeware. An inside look at a large-scale campaign

UPD 03.07.2026: added a package of rules and recommendations that help detect the described malicious activity for companies using our Kaspersky SIEM system. Introduction To access compromised systems, threat actors frequently abuse legitimate remote monitoring tools. At first glance, these...