Two vulnerabilities in the ConnectWise ScreenConnect remote desktop access software that were recently patched have been targeted by more threat actors.
The vulnerabilities, identified as CVE-2024-1709 (CVSS score of 10) and CVE-2024-1708 (CVSS score of 8.4), are classified as an authentication bypass flaw and a path traversal bug. ConnectWise revealed the security flaws on February 19, when it released patches for them. Two days later, the company updated its advisory to warn of continued exploitation.
“Essentially, a bad actor could impersonate a system administrator, delete all other users, and take over the instance,” the company warns in its advisory.
Read More: Black Basta, Bl00dy Ransomware Exploiting Recent ScreenConnect Flaws
Check Out The New ITsecuritywire Podcast. For more such updates follow us on Google News ITsecuritywire News.
