CVE-2025-3935

🗓️ 25 Apr 2025 18:27:44Reported by ConnectWiseType

cve🔗 web.nvd.nist.gov📰️ 5 Media mentions👁 400 Views

ScreenConnect version 25.2.3 and earlier are vulnerable to ASP.NET ViewState code injection attacks.

Reporter	Title	Published	Views	Family All 22
ATTACKERKB	CVE-2025-3935	25 Apr 202500:00	–	attackerkb
BDU FSTEC	The vulnerability of the ViewState mechanism of the ConnectWise ScreenConnect remote access software allows a perpetrator to execute arbitrary code.	2 Jun 202500:00	–	bdu_fstec
Circl	CVE-2025-3935	25 Apr 202518:46	–	circl
CISA KEV Catalog	ConnectWise ScreenConnect Improper Authentication Vulnerability	2 Jun 202500:00	–	cisa_kev
CISA	CISA Adds Five Known Exploited Vulnerabilities to Catalog	2 Jun 202512:00	–	cisa
CNNVD	ConnectWise ScreenConnect 授权问题漏洞	25 Apr 202500:00	–	cnnvd
Tenable Nessus	ConnectWise ScreenConnect < 25.2.4 RCE	30 May 202500:00	–	nessus
Cvelist	CVE-2025-3935 ScreenConnect Exposure to ASP.NET ViewState Code Injection	25 Apr 202518:27	–	cvelist
EUVD	EUVD-2025-12502	3 Oct 202520:07	–	euvd
NVD	CVE-2025-3935	25 Apr 202519:15	–	nvd

NVD

Node

connectwise screenconnectRange<25.2.4

[
  {
    "defaultStatus": "unaffected",
    "platforms": [
      "Microsoft ASP.NET"
    ],
    "product": "ScreenConnect",
    "vendor": "ConnectWise",
    "versions": [
      {
        "status": "affected",
        "version": "<25.2.3"
      }
    ]
  }
]

Source	Link
connectwise	www.connectwise.com/company/trust/advisories
connectwise	www.connectwise.com/company/trust/security-bulletins/screenconnect-security-patch-2025.4
cisa	www.cisa.gov/known-exploited-vulnerabilities-catalog