Executive brief
ConnectWise ScreenConnect, a remote desktop and support software, is vulnerable to a security flaw that could allow an attacker to take full control of the server. If an attacker manages to obtain specific system-level encryption keys, they can inject malicious code into the application's state management system. This could result in unauthorized access to sensitive customer data or a complete disruption of remote support operations.
Technical details
ConnectWise ScreenConnect versions 25.2.3 and earlier are vulnerable to a deserialization of untrusted data (CWE-502) via ASP.NET ViewState. While ViewState is typically protected by machine keys, an attacker who has obtained these keys through prior privileged system access can craft a malicious ViewState payload. When processed by the server, this payload can trigger remote code execution. The vulnerability is rooted in platform-level ASP.NET Web Forms behavior rather than a direct coding error in ScreenConnect itself. ConnectWise has released version 2025.4, which mitigates the risk by entirely disabling ViewState and removing dependencies on it. This vulnerability has been observed in the wild.
Affected products
- ConnectWise ScreenConnect 25.2.3 and earlier
Timeline
- 2025-04-25: disclosed
- 2025-06-02: kev added: Added to CISA Known Exploited Vulnerabilities catalog
- 2025-06-02: advisory