ScreenConnect Exposure to ASP.NET ViewState Code Injection
ScreenConnect 25.2.3 and earlier are impacted, and only where ASP.NET machine keys have been compromised. The fix is in 25.2.4.
- Published
- Last modified
- Where the record stands: published, rejected by its publisher, or superseded by another id.What do these mean? →
- published
- Whether CISA lists it in its Known Exploited Vulnerabilities catalog: proof that attackers are using it.What do these mean? →
- Listed in CISA KEV
- How many real-world setups can hit the bug, from the vendor's advisory and CISA data. It does not know your setup.What do these mean? →
- Actively exploited
- Fix
- Fixed in 25.2.3
- Whether working attack code is public (Exploit-DB, Metasploit, Nuclei or GitHub). Public code makes attacks easier.What do these mean? →
- None on Exploit-DB, Metasploit or GitHub
Summary
ScreenConnect, a remote access software product, is affected by a weakness in how its ASP.NET Web Forms handle ViewState data, which could allow an attacker who has already obtained the server's machine keys to send malicious data and potentially run code on the server. The ScreenConnect Client is not directly impacted.
Summarized by anthropic/claude-haiku-5.5. Verify details against the original sources.
Read the original description
ScreenConnect versions 25.2.3 and earlier versions may be susceptible to a ViewState code injection attack. ASP.NET Web Forms use ViewState to preserve page and control state, with data encoded using Base64 protected by machine keys. It is important to note that to obtain these machine keys, privileged system level access must be obtained. If these machine keys are compromised, attackers could create and send a malicious ViewState to the website, potentially leading to remote code execution on the server. The risk does not originate from a vulnerability introduced by ScreenConnect, but from platform level behavior. This had no direct impact to ScreenConnect Client. ScreenConnect 2025.4 patch disables ViewState and removes any dependency on it.
Timeline
- CVE published
- Added to CISA KEV
CISA has evidence of exploitation in the wild
- CISA remediation deadline
Due date for US federal agencies to patch
- Record last updated
Affected versions
- ConnectWise ScreenConnect
fixed in 25.2.3
References 2
Questions about CVE-2025-3935
What does this mean?
A ViewState code injection flaw in ScreenConnect's ASP.NET handling could let an attacker who has compromised the ASP.NET machine keys send a malicious ViewState to the website. This could lead to remote code execution on the server.Source: connectwise.com
Am I affected, and how do I check?
ScreenConnect version 25.2.3 and earlier versions are impacted. The flaw requires the ASP.NET machine keys to be compromised, which requires privileged system-level access. To check the installed version, look up the ScreenConnect version and compare it with 25.2.3.Source: connectwise.com
What should I do about it?
Install the 25.2.4 version of ScreenConnect, which is the fixed release. The installation is downloaded from the vendor's 25.2.4 release.Source: connectwise.com
Is it being exploited?
Yes. CISA added it to its Known Exploited Vulnerabilities catalog on 2025-06-02, which means it has evidence of attacks. No public exploit code is tracked.Source: cisa.gov, cve.now feed data