---
title: "CVE-2025-3935: ScreenConnect Exposure to ASP.NET… | CubePath"
description: "ScreenConnect versions 25.2.3 and earlier versions may be susceptible to a ViewState code injection attack. ASP.NET Web Forms use ViewState to preserve…"
language: en
source: https://cubepath.com/security/cve/CVE-2025-3935
---

# CVE-2025-3935: ScreenConnect Exposure to ASP.NET… | CubePath

## Description

ScreenConnect versions 25.2.3 and earlier versions may be susceptible to a ViewState code injection attack. ASP.NET Web Forms use ViewState to preserve page and control state, with data encoded using Base64 protected by machine keys. It is important to note that to obtain these machine keys, privileged system level access must be obtained. If these machine keys are compromised, attackers could create and send a malicious ViewState to the website, potentially leading to remote code execution on the server. The risk does not originate from a vulnerability introduced by ScreenConnect, but from platform level behavior. This had no direct impact to ScreenConnect Client. ScreenConnect 2025.4 patch disables ViewState and removes any dependency on it.

Official description from the CVE record, published by ConnectWise. Copyright © 1999-2026 The MITRE Corporation. See [/security/cve/legal](https://cubepath.com/security/cve/legal) for the CVE license. [View the record on cve.org](https://www.cve.org/CVERecord?id=CVE-2025-3935)

## Key data

### CVSS 3.1 High 8.1

Score published by ConnectWise in the CVE record.

CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

| Metric                 | Value     | What it means                                                                             |
| ---------------------- | --------- | ----------------------------------------------------------------------------------------- |
| Attack vector          | Network   | The vulnerable component can be reached over a network, possibly from the Internet.       |
| Attack complexity      | High      | The attack depends on conditions outside the attacker's control, so it takes preparation. |
| Privileges required    | None      | No account or privileges are needed.                                                      |
| User interaction       | None      | No action from any user is needed.                                                        |
| Scope                  | Unchanged | The impact stays within the vulnerable component.                                         |
| Confidentiality impact | High      | Serious or total effect on the secrecy of data.                                           |
| Integrity impact       | High      | Serious or total effect on the trustworthiness of data.                                   |
| Availability impact    | High      | Serious or total effect on availability.                                                  |

CVSS is owned and managed by FIRST.Org, Inc. (FIRST) and is used by permission. Each CVSS score on this site is shown together with its vector string, as published in the CVE record by the source named next to it. Learn more at [first.org/cvss](https://www.first.org/cvss/) .

### EPSS

Exploit Prediction Scoring System by FIRST: an estimate of the probability that exploitation activity will be observed in the next 30 days.

Score

0.03597 (3.6% probability)

Percentile

89.5%

Scores of

Nov 10, 2026

Model

v2026.06.15

### CISA Known Exploited Vulnerabilities

This CVE is listed in the CISA KEV catalog.

Name in the catalog

ConnectWise ScreenConnect Improper Authentication Vulnerability

Added to the catalog

Jun 2, 2025

Federal due date

Jun 23, 2025

### CISA assessment as of Jun 6, 2025

Stakeholder-Specific Vulnerability Categorization (SSVC) decision points added by CISA.

Exploitation

Recorded by CISA as active

Automatable

no

Technical impact

total

### Weakness (CWE)

CWE catalog version 5.0.

CWE names: Copyright © 2006-2026, The MITRE Corporation. See [/security/cve/legal](https://cubepath.com/security/cve/legal) for the CWE license.

- [CWE-502](https://cwe.mitre.org/data/definitions/502.html) Deserialization of Untrusted Data

## Affected products

Products listed in the CVE record, as the CNA published them.

- ConnectWise ScreenConnect

  - affected: <25.2.3

## References

Links listed in the CVE record. They lead to other sites, which CubePath does not control.

- [connectwise.com/company/trust/security-bulletins/screenconn…](https://www.connectwise.com/company/trust/security-bulletins/screenconnect-security-patch-2025.4)
- [connectwise.com/company/trust/advisories](https://www.connectwise.com/company/trust/advisories)

## Timeline

1. ID reserved Apr 25, 2025
2. Record published Apr 25, 2025
3. Added to CISA KEV Jun 2, 2025
4. Record last updated Feb 26, 2026

## Look up another CVE

## About CubePath

CubePath is a cloud provider with data centers in Europe and the United States. It offers VPS, bare metal servers and DDoS protection.

[Cloud VPS](https://cubepath.com/vps) [DDoS protection](https://cubepath.com/ddos-protection)

Data from the CVE Program (MITRE), CISA KEV and FIRST EPSS. CVSS is owned by FIRST and used by permission. Not affiliated with or endorsed by MITRE, CISA or FIRST. Data as of Nov 10, 2026, 20:02 UTC. [Sources and licenses](https://cubepath.com/security/cve/legal)