Latest ScreenConnect vulnerability #
Certain versions of ConnectWise ScreenConnect may be susceptible to ViewState code injection attacks in ASP.NET Web Forms. The ViewState is used by ASP.NET to preserve page state across multiple requests. The data is encoded using Base64 and protected by cryptographic keys referred to as machine keys. It is important to note that it typically requires privileged system level access to obtain these machine keys. This issue could potentially impact any product utilizing ASP.NET framework ViewStates. There is evidence that this vulnerability is being actively exploited in the wild.
The following versions are affected:
- ConnectWise ScreenConnect versions prior to 25.2.4
This vulnerability has been designated CVE-2025-3935 and has a CVSS score of 8.1 (high).
What is the impact? #
If machine keys are compromised, successful exploitation of the vulnerability could allow attackers to create and send a malicious ViewState to the website, potentially leading to remote code execution on the server.
Are updates or workarounds available? #
ConnectWise has released an update, 25.2.4, that fixes these issues by disabling the ViewState and removing any dependency on it. ConnectWise recommends that all users upgrade to this version immediately.
How do I find vulnerable ScreenConnect installations with runZero? #
From the Software Inventory, use the following query to locate potentially vulnerable ConnectWise ScreenConnect installations:
vendor:ConnectWise AND product:ScreenConnect AND (version:>0 AND version:<25.2.4)
Previous ScreenConnect vulnerabilities (CVE-2024-1708, CVE-2024-1709) #
On February 19, 2024, ConnectWise disclosed two serious vulnerabilities in their ScreenConnect (formerly Control) remote-access product.
The first vulnerability is an authentication bypass vulnerability. Successful exploitation of this vulnerability would allow attackers to execute arbitrary commands with full privileges on the target system. This vulnerability has been assigned a CVSS score of 10, indicating a highly critical vulnerability.
The second issue is a path-traversal vulnerability. Successful exploitation of this vulnerability would allow attackers to access restricted resources on vulnerable systems. The vendor has not disclosed what resources may be accessed when exploiting this vulnerability. This vulnerability has been assigned a CVSS score of 8.4, indicating a high severity.
Note that CVEs are not yet assigned for these vulnerabilities.
Note that there is evidence that these vulnerabilities are being actively exploited in the wild.
What is the impact? #
Successful exploitation of these vulnerabilities would allow attackers to execute arbitrary commands with full privileges on the target system, potentially leading to complete system compromise.
Are updates or workarounds available? #
ConnectWise has released an update, version 23.9.8, that fixes these issues. ConnectWise recommends that all users upgrade to this version immediately.
How do I find ScreenConnect installations with runZero? #
From the Services Inventory, use the following query to locate potentially vulnerable ConnectWise ScreenConnect systems:
vendor:ConnectWise AND (product:Control OR product:ScreenConnect)
Note the check for the former product name (“Control”).
Additional fingerprinting research is ongoing, and additional queries will be published as soon as possible.
