CVE-2025-3935
Last modified
CVE-2025-3935 is a high-severity vulnerability rated 7.2/10 on the CVSS scale. ScreenConnect versions 25.2.3 and earlier versions may be susceptible to a ViewState code injection attack. ASP.NET Web Forms use ViewState to preserve page and control state, with data encoded using Base64 protected by machine keys. It is important to note that to obtain these machine keys, privileged system level access must be obtained. CISA has confirmed active exploitation in the wild. EPSS estimates a 3.29% chance of exploitation in the next 30 days.
Description
ScreenConnect versions 25.2.3 and earlier versions may be susceptible to a ViewState code injection attack. ASP.NET Web Forms use ViewState to preserve page and control state, with data encoded using Base64 protected by machine keys. It is important to note that to obtain these machine keys, privileged system level access must be obtained. If these machine keys are compromised, attackers could create and send a malicious ViewState to the website, potentially leading to remote code execution on the server. The risk does not originate from a vulnerability introduced by ScreenConnect, but from platform level behavior. This had no direct impact to ScreenConnect Client. ScreenConnect 2025.4 patch disables ViewState and removes any dependency on it.
Metrics
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H
Exploitation Status
This vulnerability is listed in CISA’s Known Exploited Vulnerabilities catalog, confirming active exploitation in the wild. Federal agencies must remediate by .
Weakness Enumeration
Affected Software
| Vendor | Product | Versions |
|---|---|---|
| Connectwise | Screenconnect | < 25.2.4 |
References
Timeline
- Published
- Last Modified
- Status
- Analyzed
Frequently Asked Questions
What is CVE-2025-3935?
How severe is CVE-2025-3935?
How do I fix CVE-2025-3935?
How Strix Helps
- How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
- Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
- PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
- AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.
Related CVEs from 2025
- CVE-2025-3930Strapi uses JSON Web Tokens (JWT) for authentication. After …6.3
- CVE-2025-3931A flaw was found in Yggdrasil, which acts as a system broker…7.8
- CVE-2025-3932It was possible to craft an email that showed a tracking lin…6.5
- CVE-2025-3933A Regular Expression Denial of Service (ReDoS) vulnerability…5.3
- CVE-2025-39348Deserialization of Untrusted Data vulnerability in ThemeGood…9.8
- CVE-2025-39349Deserialization of Untrusted Data vulnerability in Potenzagl…9.8
- CVE-2025-39350Missing Authorization vulnerability in Rocket Apps wProject.…8.2
- CVE-2025-39351Cross-Site Request Forgery (CSRF) vulnerability in ThemeGood…4.3
- CVE-2025-39352Missing Authorization vulnerability in ThemeGoods Grand Rest…8.2
- CVE-2025-39353Missing Authorization vulnerability in ThemeGoods Grand Rest…5.3
- CVE-2025-39354Deserialization of Untrusted Data vulnerability in ThemeGood…9.8
- CVE-2025-39355Improper Neutralization of Special Elements used in an SQL C…8.5
Are you affected by CVE-2025-3935?
Run a free Strix scan to check your systems for this vulnerability.
Scan your code nowSource: NVD / NIST