CVE-2025-3935highunder attackCWE-502

CVE-2025-3935: high-severity vulnerability in ConnectWise ScreenConnect

ScreenConnect Exposure to ASP.NET ViewState Code Injection

Published · Updated

Follow this CVE+ Monitor ScreenConnect

E-mail alert when it lands in KEV, gets a public PoC or its score goes up.

51Vexday Risk Score

Prioritize patching. It under exploitation confirmed by CISA.

ssvc Actcvss 8.1epss 3.6%
from disclosure to weapon
Published on NVDApr 25
CISA KEV+38d
Action required by CISAfederal deadline: 2025-06-23

Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.

In short

ScreenConnect versions up to 25.2.3 can be attacked through ASP.NET ViewState if server encryption keys are stolen, allowing attackers to inject malicious code and run commands on the server. This requires prior admin-level access to extract the keys.

Technical detail

ViewState code injection vulnerability in ASP.NET Web Forms (CWE-502) affecting ScreenConnect ≤25.2.3. Attack vector requires prior compromise of machine-level encryption keys; attacker can then craft malicious Base64-encoded ViewState payloads to achieve remote code execution. Mitigation involves disabling ViewState (addressed in version 2025.4).

Summary generated and translated by AI from the official description.

The full analysis of this CVE is available in Portuguese →

ScreenConnect versions 25.2.3 and earlier versions may be susceptible to a ViewState code injection attack. ASP.NET Web Forms use ViewState to preserve page and control state, with data encoded using Base64 protected by machine keys.  It is important to note that to obtain these machine keys, privileged system level access must be obtained. If these machine keys are compromised, attackers could create and send a malicious ViewState to the website, potentially leading to remote code execution on the server.  The risk does not originate from a vulnerability introduced by ScreenConnect, but from platform level behavior.  This had no direct impact to ScreenConnect Client. ScreenConnect 2025.4 patch disables ViewState and removes any dependency on it.
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
Affected products
ConnectWise · ScreenConnect
Related CVEs — ConnectWise ScreenConnect

In the same product, most dangerous first.

CVE-2024-1709CRITICALAuthentication bypass using an alternate path or channelEPSS 100.0%KEVCVE-2024-1708HIGHImproper limitation of a pathname to a restricted directory (“path traversal”)EPSS 95.4%KEVCVE-2026-84869CRITICALScreenConnect Client: Guest-to-Host File Execution via File-Transfer ActionsEPSS 0.9%KEVCVE-2022-36781MEDIUMConnectWise - ScreenConnect Session Code BypassEPSS 0.6%CVE-2026-3564CRITICALScreenConnect Instance Level Cryptographic Material ExposureEPSS 0.4%CVE-2025-14265CRITICALImproper server-side validation in ScreenConnect extension frameworkEPSS 0.4%