DaystoPatch

ConnectWiseExploited incident

ConnectWise ScreenConnect ViewState code injection (ScreenConnect 25.2.4 security patch)

CVE-2025-3935High, CVSS 8.1In CISA's Known Exploited Vulnerabilities catalog since 2 Jun 2025

  • Exploited before a fix
FixedFixed for every supported version on the day it became public.

Response

Silence
same day
First public report to first vendor statement
Exposure
same day
First public report to first fix
Follow-through
same day
First public report to a fix for every supported version
  • Vendor silent
  • Vendor statement, no fix
  • Fixed for some versions
  • Fixed when disclosed
  • Date only, no time of day

Timeline and evidence

Open a moment to see its source and archived quote.

  1. First public report

    date only

    ConnectWise security bulletin: ScreenConnect 25.2.4 Security Patch (04/24/2025)CuratedQuote verified

    ScreenConnect versions 25.2.3 and earlier versions may be susceptible to a ViewState code injection attack.

    First public signal of the bug: the bulletin dated 04/24/2025, shipped with the fix.

    Recorded time
    Precision
    Date only (no time of day is shown)
    Origin
    Curated. Found by a researcher, with a verbatim quote and link.
    Quote check
    Found in the archived copy
    Snapshot
    sha256:d724073b411b80f1…
    Used in metrics
    Yes
    Dispute this timestamp
    5 more sources for this moment
    CVE.org record CVE-2025-3935ClaimedQuote verified25 Apr 2025, 18:27 UTC

    ScreenConnect versions 25.2.3 and earlier versions may be susceptible to a ViewState code injection attack. ASP.NET Web Forms use ViewState to preserve page and control state, with data encoded

    CVE record published.

    Recorded time
    Precision
    To the minute
    Origin
    Claimed. The date the source gives.
    Quote check
    Found in the archived copy
    Snapshot
    sha256:a0fe842875e4c15a…
    Used in metrics
    No, kept for the record
    Dispute this timestamp
    Bluesky postClaimedQuote not checked yet25 Apr 2025, 22:19 UTC

    CVE-2025-3935 - ScreenConnect ASP.NET ViewState Code Injection Vulnerability

    Earliest third-party post we hold.

    Source
    Bluesky post social
    Recorded time
    Precision
    To the minute
    Origin
    Claimed. The date the source gives.
    Quote check
    Not checked yet
    Snapshot
    No archived snapshot
    Used in metrics
    No, kept for the record
    Dispute this timestamp
    Mastodon postClaimedQuote not checked yet26 Apr 2025, 04:44 UTC

    CVE Alert: CVE-2025-3935 - https://www. redpacketsecurity.com/cve_aler t_cve-2025-3935/ # OSINT # ThreatIntel # CyberSecurity # cve_2025_3935

    Earliest third-party post we hold.

    Source
    Mastodon post social
    Recorded time
    Precision
    To the minute
    Origin
    Claimed. The date the source gives.
    Quote check
    Not checked yet
    Snapshot
    No archived snapshot
    Used in metrics
    No, kept for the record
    Dispute this timestamp
    The Hacker News (May 2025), quoting ConnectWise's advisory of May 28, 2025CuratedQuote verified28 May 2025

    which affected a very small number of ScreenConnect customers," the company said in a brief advisory on May 28, 2025.

    First public report of exploitation (a nation-state intrusion affecting ScreenConnect cloud customers). The article's later update says ConnectWise confirmed the activity is linked to CVE-2025-3935.

    Recorded time
    Precision
    Date only (no time of day is shown)
    Origin
    Curated. Found by a researcher, with a verbatim quote and link.
    Quote check
    Found in the archived copy
    Snapshot
    sha256:d1562d0e332d2270…
    Used in metrics
    No, kept for the record
    Dispute this timestamp
    CISA KEV (CVE-2025-3935)ClaimedQuote verified2 Jun 2025

    ConnectWise ScreenConnect Improper Authentication Vulnerability

    Added to CISA's KEV catalog on 2025-06-02.

    Recorded time
    Precision
    Date only (no time of day is shown)
    Origin
    Claimed. The date the source gives.
    Quote check
    Found in the archived copy
    Snapshot
    sha256:ef8fffede5c47200…
    Used in metrics
    No, kept for the record
    Dispute this timestamp

  2. Vendor statement

    date onlysame day

    ConnectWise security bulletin: ScreenConnect 25.2.4 Security Patch (04/24/2025)CuratedQuote verified

    04/24/2025

    Recorded time
    Precision
    Date only (no time of day is shown)
    Origin
    Curated. Found by a researcher, with a verbatim quote and link.
    Quote check
    Found in the archived copy
    Snapshot
    sha256:d724073b411b80f1…
    Used in metrics
    Yes
    Dispute this timestamp

  3. First workaround

    No official mitigation found yet.

  4. First fix

    date onlysame day

    ConnectWise security bulletin: ScreenConnect 25.2.4 Security Patch (04/24/2025)CuratedQuote verified

    Our patch disables ViewState and removes any dependency on it.

    Cloud instances ('screenconnect.com', 'hostedrmm.com') were updated by ConnectWise; on-premises partners install 25.2.4.

    Recorded time
    Precision
    Date only (no time of day is shown)
    Origin
    Curated. Found by a researcher, with a verbatim quote and link.
    Quote check
    Found in the archived copy
    Snapshot
    sha256:d724073b411b80f1…
    Used in metrics
    Yes
    Dispute this timestamp

  5. Fixed for all versions

    date onlysame day

    ConnectWise security bulletin: ScreenConnect 25.2.4 Security Patch (04/24/2025)CuratedQuote verified

    If you are on 25.2.3 or an earlier version, you should install the latest build for your current version to receive the latest security updates.

    The bulletin directs every on-premises version to the latest build for its version; off-maintenance licences must be upgraded first. ConnectWise later urged all customers to patch 'even if not on maintenance' (per The Hacker News).

    Recorded time
    Precision
    Date only (no time of day is shown)
    Origin
    Curated. Found by a researcher, with a verbatim quote and link.
    Quote check
    Found in the archived copy
    Snapshot
    sha256:d724073b411b80f1…
    Used in metrics
    Yes
    Dispute this timestamp

This advisory changed after publication

  1. screenconnect-security-patch-2025.4

    Changed without a revision note

    ScreenConnect 25.2.4 Security Patch

    CVSS base vector changed from AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H to AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H.

    • Severity
    CVSS vector
    BeforeAV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
    AfterAV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
    Verbatim wording. Removed text is struck through. Added text is bold.
    Before

    tes, and ScreenConnect is not an outlier. Vulnerability CWE ID | Description | Base Score | Vector CWE-287 | Improper Authentication | 8.8 | CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H Severity High—Vulnerabilities that could compromise confidential data or other processing resources but require additional access / privilege to do so. Priority 1 High—Vulnerabilities that are either being targeted

    After

    tes, and ScreenConnect is not an outlier. Vulnerability CWE ID | Description | Base Score | Vector CWE-287 | Improper Authentication | 8.1 | CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H Severity Important—Vulnerabilities that could compromise confidential data or other processing resources but require additional access / privilege to do so. Priority 1 High—Vulnerabilities that are either being tar

    Earlier version captured 25 Apr 2025, 11:15 UTC: archived copyLater version captured 26 Apr 2025, 02:44 UTC: archived copyRecovered from archived copiesSnapshots 710f44f14a… and 9247f826e9…Incident page

Send this to your boss

No brief for this incident yet. We write one for every open incident and every critical bug exploited before a fix.

Affected products

  • ConnectWise ScreenConnect 25.2.3 and earlier (on-premises and cloud)
How we built this timeline

exploited before a fix=true under R4: ConnectWise links the nation-state activity to CVE-2025-3935 and says 'We have not seen any suspicious ScreenConnect activity since releasing the patch on April 24' (quoted by The Hacker News), i.e. exploitation began before the fix; it was made public on 28 May 2025. BleepingComputer reported the breach may have begun in August 2024 but could not verify this.

Exploitation requires the ASP.NET machine keys, which need privileged system-level access. CVSS 8.1 is ConnectWise's score (NVD: 7.2).

Related

No related incidents.

ConnectWise report card