CVE-2025-3935
📋 TL;DR
CVE-2025-3935 is a ViewState code injection vulnerability affecting ScreenConnect versions 25.2.3 and earlier. Attackers with compromised machine keys can craft malicious ViewState payloads to achieve remote code execution on the server. This affects organizations using vulnerable ScreenConnect installations, particularly those exposed to the internet.
💻 Affected Systems
- ScreenConnect
📦 What is this software?
Screenconnect by Connectwise
⚠️ Risk & Real-World Impact
Worst Case
Full remote code execution on the ScreenConnect server, allowing complete system compromise, data theft, and lateral movement within the network.
Likely Case
Attackers with initial access escalate privileges to execute arbitrary code on the server, potentially deploying ransomware or establishing persistent backdoors.
If Mitigated
With proper network segmentation and access controls, impact is limited to the ScreenConnect server itself, though data exfiltration remains possible.
🎯 Exploit Status
Exploitation requires obtaining machine keys first, which adds a prerequisite step. Once keys are obtained, ViewState manipulation is well-documented in ASP.NET.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: ScreenConnect 2025.4
Vendor Advisory: https://www.connectwise.com/company/trust/advisories
Restart Required: Yes
Instructions:
1. Download ScreenConnect 2025.4 from ConnectWise portal. 2. Backup current installation. 3. Run installer with administrative privileges. 4. Restart ScreenConnect services. 5. Verify ViewState is disabled in configuration.
🔧 Temporary Workarounds
Disable ViewState manually
allManually disable ViewState in web.config to prevent exploitation
Edit web.config: <pages enableViewState="false" />
Rotate machine keys
windowsGenerate new machine keys to invalidate any compromised keys
Use ASP.NET IIS Manager or generate via: aspnet_regiis -pc "MyKeys" -exp
🧯 If You Can't Patch
- Isolate ScreenConnect server from internet with firewall rules
- Implement strict access controls and monitor for unusual authentication attempts
🔍 How to Verify
Check if Vulnerable:
Check ScreenConnect version in Admin panel or via Help > About. Versions 25.2.3 or earlier are vulnerable.Check Version:
On Windows: sc query "ScreenConnect Client" | findstr DisplayName. On Linux: systemctl status screenconnectVerify Fix Applied:
Verify version is 2025.4 or later and check that ViewState is disabled in web.config (enableViewState="false").📡 Detection & Monitoring
Log Indicators:
- Unusual authentication patterns
- Large or malformed ViewState parameters in IIS logs
- Unexpected process creation from w3wp.exe
Network Indicators:
- Unusual outbound connections from ScreenConnect server
- Suspicious PowerShell or command execution patterns
SIEM Query:
source="iis" AND (url="*__VIEWSTATE*" AND size>10000) OR process_name="w3wp.exe" AND child_process="powershell.exe"