CVE-2025-3935

Katalog CVE

CVSS 7.2 · High KEV · sudah dieksploitasi EPSS 3,5%

Kerentanan Deserialization of Untrusted Data pada connectwise screenconnect. Skor CVSS 3.1 7.2 (High) menurut NVD. Masuk katalog KEV CISA pada 2 Juni 2025, artinya sudah terbukti dieksploitasi.

Deskripsi (NVD)

ScreenConnect versions 25.2.3 and earlier versions may be susceptible to a ViewState code injection attack. ASP.NET Web Forms use ViewState to preserve page and control state, with data encoded using Base64 protected by machine keys.  It is important to note that to obtain these machine keys, privileged system level access must be obtained. If these machine keys are compromised, attackers could create and send a malicious ViewState to the website, potentially leading to remote code execution on the server.  The risk does not originate from a vulnerability introduced by ScreenConnect, but from platform level behavior.  This had no direct impact to ScreenConnect Client. ScreenConnect 2025.4 patch disables ViewState and removes any dependency on it.

Rincian

Terbit di NVD

25 April 2025

Terakhir diubah

17 Juni 2026

Status NVD

Analyzed

CVSS 3.1

7.2 (High), sumber NVD
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-502: Deserialization of Untrusted Data

EPSS (30 hari)

3,5% peluang dieksploitasi; lebih tinggi dari 88,9% CVE lain

Known Exploited Vulnerabilities (CISA)

Nama

ConnectWise ScreenConnect Improper Authentication Vulnerability

Masuk KEV

2 Juni 2025

Tenggat CISA

23 Juni 2025 (untuk instansi federal AS)

Ransomware

Belum tercatat

Tindakan wajib

Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.

Produk dan versi terdampak

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

• https://www.connectwise.com/company/trust/advisories advisory vendor
• https://www.connectwise.com/company/trust/security-bulletins/screenconnect-security-patch-2025.4 advisory vendor
• https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2025-3935 pemerintah AS