ConnectWise PSA 2025.9 Security Fix

07/09/2025

Products: ConnectWise PSA
Severity: Moderate
Priority: 2 - Moderate

Summary

In ConnectWise PSA versions older than 2025.9, a vulnerability exists where authenticated users could gain access to sensitive user information. Specific API requests were found to return an overly verbose user object, which included encrypted password hashes for other users. Authenticated users could then retrieve these hashes.

An attacker or privileged user could then use these exposed hashes to conduct offline brute-force or dictionary attacks. Such attacks could lead to credential compromise, allowing unauthorized access to accounts, and potentially privilege escalation within the system.

Vulnerability

CVE-2025-7204

CWE ID         Description                             Base Score                         Vector

CWE-201      Insertion of Sensitive Information Into Sent Data      6.5      CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

Severity

Moderate — Vulnerabilities where impact is limited to a significant degree by mitigating factors such as version / configuration, detective controls, or are otherwise difficult to exploit

Priority 

2 Moderate — Vulnerabilities that have elevated risk but exploits are neither known nor anticipated to be imminent. Recommend updates be prioritized against normal change management timelines but no longer than 30 days.

Affected versions

All versions prior to 2025.9

Remediation

Cloud

Cloud instances are automatically being updated to the latest ConnectWise PSA release.

On-premise

Apply the 2025.9 release patches and ensure all desktop clients are up to date.