Summary  

ScreenConnect versions 25.2.3 and earlier versions may be susceptible to a ViewState code injection attack.ASP.NET Web Forms use ViewState to preserve page and control state, with data encoded using Base64 protected by machine keys. It is important to note that to obtain these machine keys, privileged system level access must be obtained. If these machine keys are compromised, attackers could create and send a malicious ViewState to the website, potentially leading to remote code execution on the server. Our patch disables ViewState and removes any dependency on it.  

It is crucial to understand that this issue could potentially impact any product utilizing ASP.NET framework ViewStates, and ScreenConnect is not an outlier.
 

Vulnerability  

CVE-2025-3935

Severity 

Important—Vulnerabilities that could compromise confidential data or other processing resources but require additional access / privilege to do so. 

Priority  

1 High—Vulnerabilities that are either being targeted or have higher risk of being targeted by exploits in the wild. Recommend installing updates as emergency changes or as soon as possible (e.g., within days).   

Affected versions  

ScreenConnect version 25.2.3 and earlier versions are impacted. 

Remediation  

Cloud 

No action is required. ScreenConnect servers hosted in “screenconnect.com” cloud (standalone and Automate/RMM integrated) or “hostedrmm.com” for Automate partners have been updated to remediate the issue.  

On-premises 

Please note there are some actions you need to take to apply this update:  

• Navigate to your Administration/License page.  

• Expand the Version Check box.  

• If you are on 25.2.3 or an earlier version, you should install the latest build for your current version to receive the latest security updates. 

• If your license is out of maintenance, you must upgrade your license before installing the latest supported release of ScreenConnect. 

• Visit our Download page. Download the 25.2.4 version installation. 

• Follow these steps to upgrade: Upgrade an on-premises installation - ConnectWise  
  
  

On-premise: Active maintenance  

If you are on active maintenance, we strongly recommend upgrading to the current release of 25.2.4. Using the most current release of ScreenConnect includes security updates, bug fixes, and enhancements not found in older releases. 

On-premise: Off maintenance  

We recommend renewing maintenance and upgrading to the newest release, 25.2.4. Please see the above instructions for how to upgrade to the newest version of ScreenConnect and to check your maintenance status.   

If you elect not to renew maintenance, we have released free security patches for select older versions dating back to release 23.9. Versions of ScreenConnect can be downloaded from the ConnectWise website: https://screenconnect.com/download/archive The updated releases will have a publish date of April 22nd, 2025, or later. Partners on a version older than 23.9 will be able to upgrade to 23.9 at no additional charge. 

How can partners protect themselves? 

There are many things that a partner can do to protect themselves. In this situation, the most important thing you can do is patch your instances immediately.  

As a reminder and as part of the remediation process for on-premises partners—whether you have patched your server or still need to—it is critical to assess your systems for signs of impact while upgrading and before bringing any systems back online. 

What actions can you take if you suspect you have been compromised? 

If you suspect that your ScreenConnect software may have been compromised, it is crucial to prioritize the security of your systems. Follow your established incident response procedures to isolate the affected servers and create backups for later analysis. Do not bring these servers back online until they have been thoroughly investigated, rebuilt, and updated with the latest patches. 
 
Keep in mind that a compromised ScreenConnect server may not be the sole point of entry. Your incident response plan should cover your entire system to detect and address any broader security vulnerabilities. 

If you have concerns about a potential compromise, please refer to the steps outlined in this Security alert checklist which includes actions such as resetting their passwords, reviewing the audit log, forcing all technicians to sign back in, and more. We also recommend reviewing the  ScreenConnect security guide  and best practices to enhance the security of your instance, as well as verifying that links, your account ID, and your domain are accurate.