ScreenConnect™ Certificate Signing Extension 1.0.12 Security Update
Date: 12/18/2025
Product(s): ConnectWise ScreenConnect
Severity: Moderate
Priority: 2 – Moderate
Summary
The ScreenConnect™ Certificate Signing Extension may include encrypted configuration values in responses sent to unauthenticated users. While these values remain encrypted and securely stored at rest, an encrypted representation could still be transmitted through client-facing components.
Updating the Certificate Signing Extension to version 1.0.12 or higher ensures configuration handling occurs exclusively on the server side, preventing encrypted configuration values from being transmitted to or rendered by client-side components.
Vulnerability
CVE-2025-14823
| CWE ID | Description | Base Score | Vector |
|---|---|---|---|
| CWE-201 | Insertion of Sensitive Information Into Sent Data |
5.3 | CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H |
Severity
Moderate — Vulnerabilities where impact is limited to a significant degree by mitigating factors such as version / configuration, detective controls, or are otherwise difficult to exploit.
Priority
2 Moderate — Vulnerabilities that have elevated risk but exploits are neither known nor anticipated to be imminent. Recommend updates be prioritized against normal change management timelines but no longer than 30 days.
Affected versions
ScreenConnect deployments using the Certificate Signing Extension versions prior to 1.0.12 are affected.
Remediation
Cloud
No action is required. ScreenConnect servers hosted in “screenconnect.com” cloud (standalone and Automate/RMM integrated) or “hostedrmm.com” for Automate partners have been updated to remediate the issue.
On-prem
On-premises partners should ensure the Certificate Signing Extension is updated to version 1.0.12 or higher to address this issue and benefit from the latest security improvements.