CVE-2025-14823

connectwise screenconnect

TLP:CLEAR

csirt@kutim:~/threat-intel/cve/CVE-2025-14823

Katalog CVE

CVSS 5.3 · Medium EPSS 0,15%

Kerentanan Insertion of Sensitive Information Into Sent Data pada connectwise screenconnect. Skor CVSS 3.1 5.3 (Medium) menurut CNA.

Deskripsi (NVD)

In deployments using the ScreenConnect™ Certificate Signing Extension, encrypted configuration values including an Azure Key Vault-related key, could be returned to unauthenticated users through a client-facing endpoint under certain conditions. The values remained encrypted and securely stored at rest; however, an encrypted representation could be exposed in client responses. Updating the Certificate Signing Extension to version 1.0.12 or higher ensures configuration handling occurs exclusively on the server side, preventing encrypted values from being transmitted to or rendered by client-side components.

Rincian

Terbit di NVD
18 Desember 2025
Terakhir diubah
17 Juni 2026
Status NVD
Analyzed
CVSS 3.1
5.3 (Medium), sumber CNA
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N · uraikan di kalkulator
Jenis kelemahan (CWE)
CWE-201: Insertion of Sensitive Information Into Sent Data
EPSS (30 hari)
0,15% peluang dieksploitasi; lebih tinggi dari 3,8% CVE lain

Produk dan versi terdampak

VendorProdukVersi terdampak
connectwise screenconnect Semua versi sebelum 1.0.12

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

Sumber: NVD · CVE.org · EPSS. Halaman ini disusun otomatis dari data tersebut; pembaruan terakhir 5 Okt 2026, 20:11 WITA. Kalau sistem di Perangkat Daerah memakai produk ini dan butuh bantuan, laporkan lewat kanal pelaporan.