Vulnerability record · CVE-2025-3935 · published 25 April 2025
CVE-2025-3935: ScreenConnect ViewState code injection enables RCE
Connectwise · Screenconnect
ScreenConnect 25.2.3 and earlier rely on ASP.NET ViewState protected by machine keys, and if those keys are compromised an attacker can craft a malicious ViewState that leads to remote code execution on the server. The flaw stems from platform-level ASP.NET behavior rather than ScreenConnect code, and the 2025.4 patch disables ViewState entirely.
Description
ScreenConnect versions 25.2.3 and earlier versions may be susceptible to a ViewState code injection attack. ASP.NET Web Forms use ViewState to preserve page and control state, with data encoded using Base64 protected by machine keys. It is important to note that to obtain these machine keys, privileged system level access must be obtained. If these machine keys are compromised, attackers could create and send a malicious ViewState to the website, potentially leading to remote code execution on the server. The risk does not originate from a vulnerability introduced by ScreenConnect, but from platform level behavior. This had no direct impact to ScreenConnect Client. ScreenConnect 2025.4 patch disables ViewState and removes any dependency on it.
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H
Automated analysis
high priorityIt is in CISA KEV with a near-term remediation deadline and can yield remote code execution, though exploitation requires prior privileged access to machine keys.
What it is
ScreenConnect 25.2.3 and earlier rely on ASP.NET ViewState protected by machine keys, and if those keys are compromised an attacker can craft a malicious ViewState that leads to remote code execution on the server. The flaw stems from platform-level ASP.NET behavior rather than ScreenConnect code, and the 2025.4 patch disables ViewState entirely.
Impact
An attacker with the machine keys can inject a crafted ViewState and execute arbitrary code on the ScreenConnect server, giving full control of the host.
Attack surface
Reachable over the network via the web interface (AV:N), but exploitation requires privileged system-level access to first obtain the machine keys (PR:H); no user interaction is needed (UI:N).
Exploitation
CISA added it to KEV on 2025-06-02 with a 2025-06-23 remediation due date, indicating known exploitation; EPSS 30-day probability is about 3.4% (88th percentile). No ransomware campaign use is documented.
What to do
- Apply the ScreenConnect 2025.4 patch, which disables ViewState and removes the dependency on it.
- If patching is delayed, follow ConnectWise advisory guidance and CISA BOD 22-01 actions, including discontinuing use where mitigations are unavailable.
- Rotate and protect ASP.NET machine keys, restricting system-level access that would allow key theft.
- Restrict network exposure of the ScreenConnect server to trusted management networks.
- Monitor for unauthorized changes to machine key configuration and web server files.
Detection
- Alert on anomalous or oversized Base64 ViewState parameters in requests to ScreenConnect endpoints.
- Monitor for unexpected w3wp.exe child processes or outbound connections from the ScreenConnect server.
- Audit access to machine key storage and configuration files for unauthorized reads.
- Review web server logs for POST requests with tampered __VIEWSTATE fields.
This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.
Exploitation in the wild
CISA added CVE-2025-3935 to the Known Exploited Vulnerabilities catalog on 2 June 2025 as "ConnectWise ScreenConnect Improper Authentication Vulnerability". Required action: Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable. Federal deadline 23 June 2025.
Affected products
1 vulnerable configurations from NVD's CPE data, grouped by vendor and product.
References
| Link | Tags |
|---|---|
| https://www.connectwise.com/company/trust/advisories | Vendor Advisory |
| https://www.connectwise.com/company/trust/security-bulletins/screenconnect-security-patch-2025.4 | Vendor Advisory |
| https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2025-3935 | US Government Resource |
Track CVE-2025-3935 inside VULONE
Watch it alongside the ransomware crews, C2 infrastructure and forum chatter that reference it, query it through the API and pull it into your SIEM over TAXII.
Related vulnerabilities
Same products first, then exploited flaws of the same weakness class.
Source: NIST National Vulnerability Database (record CVE-2025-3935), CISA KEV, FIRST EPSS (scores of 2026-09-29). This page is refreshed as NVD updates the record.
