SlashAndGrab: The ConnectWise ScreenConnect Vulnerability Explained | Huntress

Huntress documents a critical authentication-bypass and path-traversal vulnerability in ConnectWise ScreenConnect (CVE-2024-1709, CVE-2024-1708) exploitable via a trivial "SlashAndGrab" technique; public PoCs enabled rapid in-the-wild abuse where attackers deployed ransomware, coin miners, and backdoors. Huntress conducted rapid analysis, issued detections and Sigma rules, deployed a protective vaccine to endpoints, and published post-exploitation tradecraft and remediation guidance to help defenders hunt and remediate compromises.