CVE-2025-3935
ConnectWise ScreenConnect Improper Authentication Vulnerability
Description
CVE-2025-3935 is a high-severity ViewState deserialization vulnerability in ConnectWise ScreenConnect versions 25.2.3 and earlier that can lead to remote code execution on the server. The vulnerability stems from ASP.NET Web Forms' use of ViewState, which preserves page state using Base64-encoded data protected by machine keys. If an attacker obtains these machine keys—which requires prior privileged system access—they can craft a malicious ViewState payload that executes arbitrary code when deserialized by the ScreenConnect server. Rated with a CVSS v3.1 score of 8.1 (HIGH), CISA has added CVE-2025-3935 to the Known Exploited Vulnerabilities catalog with a remediation deadline of June 23, 2025, and its EPSS score of 15.50% at the 94.53rd percentile indicates high exploitation probability.
KEV Information
CVSS Score
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:HOpen in CalculatorAffected Products
| Vendor | Product | Version |
|---|---|---|
| connectwise | screenconnect | < 25.2.4 |
Multiple CVSS Assessments
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H
References
- https://www.connectwise.com/company/trust/advisories(Vendor Advisory)
- https://www.connectwise.com/company/trust/security-bulletins/screenconnect-security-patch-2025.4(Vendor Advisory)
- https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2025-3935(US Government Resource)
Weakness Type
CWE-502: Deserialization of Untrusted Data
CVE-2025-3935 is classified under CWE-502 (Deserialization of Untrusted Data), which occurs when an application deserializes data from an untrusted source without verifying its safety. In ConnectWise ScreenConnect, ASP.NET ViewState data is deserialized during page processing. When an attacker possesses the machine keys used to sign ViewState payloads, they can craft malicious serialized objects that execute arbitrary code during the deserialization process, achieving remote code execution on the ScreenConnect server.
Learn more: CWE-502 — Deserialization of Untrusted Data
Impact Analysis
CVE-2025-3935 presents severe potential impact despite requiring high attack complexity. The vulnerability is network-exploitable (AV:N) with high complexity (AC:H) because the attacker must first obtain the ASP.NET machine keys through separate privileged access. No authentication (PR:N) or user interaction (UI:N) is required once the machine keys are compromised. Confidentiality (High): Successful code execution on the ScreenConnect server exposes all managed endpoint data, remote access session information, credentials stored by the application, and potentially access to every system managed through the ScreenConnect deployment. Integrity (High): An attacker with code execution can modify the ScreenConnect server to push malicious commands to all connected endpoints, alter access logs, and establish persistent backdoors. Availability (High): The attacker can disable the ScreenConnect service, affecting remote management capabilities for all connected endpoints. The EPSS score of 15.50% at the 94.53rd percentile reflects very high exploitation probability, which is expected given ScreenConnect's popularity as a remote management tool and previous high-profile exploitation of ScreenConnect vulnerabilities.
Exploit Maturity
CVE-2025-3935 has been confirmed as actively exploited with CISA adding it to the Known Exploited Vulnerabilities catalog. The EPSS score of 15.50% at the 94.53rd percentile indicates very high exploitation probability, placing it in the top 5.5% of all vulnerabilities. While the vulnerability requires obtaining machine keys through prior privileged access, the ConnectWise advisories at connectwise.com/company/trust/advisories and the ScreenConnect security patch bulletin confirm the practical exploitability. ConnectWise ScreenConnect has been a high-value target for threat actors, particularly ransomware operators, following the critical CVE-2024-1709 authentication bypass that was widely exploited in early 2024, making any new ScreenConnect vulnerability an immediate priority.
Remediation
-
Upgrade ScreenConnect immediately to version 2025.4 or later, which completely removes the ViewState dependency and eliminates the attack surface. The security patch is available at ConnectWise Security Bulletins. If immediate upgrade is not possible, update to at least version 25.2.4 as an interim fix.
-
Rotate ASP.NET machine keys on all ScreenConnect server instances. If machine keys have been potentially compromised, generate new keys and update the configuration to invalidate any previously crafted malicious ViewState payloads.
-
Audit server access logs for evidence of machine key theft or unauthorized ViewState submissions. Review Windows event logs, IIS logs, and ScreenConnect application logs for suspicious authentication attempts, unusual remote access patterns, or indicators of prior system compromise.
-
Implement network access controls to restrict access to the ScreenConnect server's web interface. Limit administrative access to trusted IP ranges and deploy a web application firewall (WAF) capable of inspecting ViewState payloads for anomalous content.
-
Conduct endpoint compromise assessment for all systems managed through ScreenConnect. If the server was compromised, the attacker potentially had access to execute commands on all connected endpoints, necessitating a thorough investigation of managed systems.
Technical Details
CVE-2025-3935 is a ViewState code injection vulnerability in ConnectWise ScreenConnect versions 25.2.3 and earlier. The CVSS v3.1 vector CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H indicates network exploitation with high attack complexity due to the prerequisite of obtaining ASP.NET machine keys. ASP.NET Web Forms use ViewState to persist page and control state between HTTP requests, serializing this state as Base64-encoded data protected by machine key-based MAC verification. When an attacker obtains the machine keys (through separate privileged system access, configuration file exposure, or other means), they can forge valid ViewState payloads containing malicious serialized objects. Upon deserialization by the ScreenConnect server's ASP.NET runtime, these objects execute arbitrary code. ConnectWise notes that the risk originates from ASP.NET platform-level behavior rather than a vulnerability introduced by ScreenConnect code, but the practical impact remains server compromise. The ScreenConnect 2025.4 patch addresses this by disabling ViewState entirely and removing all dependency on it.
Frequently Asked Questions
Is CVE-2025-3935 being actively exploited?
Yes. CISA has confirmed active exploitation of CVE-2025-3935. The EPSS score of 15.50% at the 94.53rd percentile indicates very high exploitation probability. ScreenConnect has historically been a high-priority target for threat actors, especially ransomware groups.
What products are affected by CVE-2025-3935?
ConnectWise ScreenConnect versions 25.2.3 and earlier are affected. The ScreenConnect client component is not directly impacted, but server compromise could affect all managed endpoints.
How do I fix CVE-2025-3935?
Upgrade to ScreenConnect 2025.4, which completely removes the ViewState dependency. If immediate upgrade is not possible, update to version 25.2.4 as an interim measure and rotate your ASP.NET machine keys.
How severe is CVE-2025-3935?
CVE-2025-3935 has a CVSS score of 8.1 (HIGH). While exploitation requires prior access to machine keys (high complexity), successful exploitation leads to remote code execution on the ScreenConnect server, potentially compromising all managed endpoints.
Need Help With Vulnerability Management?
Our security experts can help you prioritize and remediate vulnerabilities effectively.