CVE-2025-3935: ScreenConnect Exposure to ASP.NET ViewState Code Injection
ConnectWise · ScreenConnect
Vendor fix available · Affected: ConnectWise ScreenConnect · Exploitation: in CISA KEV since 2 Jun 2025
Not in CyberSIXT coverage yet: no article names this CVE. This page shows the public record.
ExploitationIn CISA KEV
- In CISA KEVCISA KEV catalogue2 Jun 2025
- Exploited (reported): not seen
- Scanning observed: not seen
- Proof of concept public: not seen
- Not established: not seen
Higher than 89% of scored CVEs
DescriptionCVE.org
ScreenConnect versions 25.2.3 and earlier versions may be susceptible to a ViewState code injection attack. ASP.NET Web Forms use ViewState to preserve page and control state, with data encoded using Base64 protected by machine keys. It is important to note that to obtain these machine keys, privileged system level access must be obtained. If these machine keys are compromised, attackers could create and send a malicious ViewState to the website, potentially leading to remote code execution on the server. The risk does not originate from a vulnerability introduced by ScreenConnect, but from platform level behavior. This had no direct impact to ScreenConnect Client. ScreenConnect 2025.4 patch disables ViewState and removes any dependency on it.
Affected products1
From the CVE record. A product or version that is not listed is unknown, not unaffected.
- ConnectWise · ScreenConnect<25.2.3
On the Atlas
Every published CVE is on the CyberSIXT Atlas, grouped by weakness, vendor and month.
- Exploitation
- Exploited in the wild. Listed in the CISA Known Exploited Vulnerabilities catalogue.
- CISA KEV
- Listed since 2 Jun 2025 · catalogue entry
- Public check
- No public nuclei template
- Vendor
- ConnectWise
- Published
- April 2025
What changed
- CISA added it to the KEV catalogue CISA
CoverageNo articles yet
No CyberSIXT article names CVE-2025-3935 yet, so there is no coverage timeline, action brief or change log for it. Everything on this page comes from the public CVE record, CISA KEV, EPSS and the nuclei template index. Search the archive or see the CVEs in the news.