CVE-2025-3935: ConnectWise ScreenConnect Improper Authentication Vulnerability Allows Potential RCE
What It Is — ConnectWise ScreenConnect contains an improper authentication flaw that enables a ViewState code‑injection attack. If an attacker can inject malicious ViewState data and obtain the machine‑key, they may achieve remote code execution on the host running ScreenConnect.
Exploitability — No public exploit has been observed in the wild, but proof‑of‑concept code is available. The vulnerability carries a CVSS v3.1 base score of 8.6 (High), indicating a serious risk if unpatched.
Affected Products — ConnectWise ScreenConnect (all versions released before the vendor‑issued patch on 2025‑09‑15).
Why It Matters for Trust & Control Assurance
- Demonstrates the need for continuous verification that authentication controls (e.g., proper session handling, ViewState integrity) are enforced and auditable.
- Highlights the importance of maintaining up‑to‑date patch‑management evidence to satisfy auditors and enterprise buyers demanding a defensible security posture.
- Shows that remote‑access and support tools must be included in any organization’s control‑monitoring program, as they are frequent vectors for supply‑chain and third‑party risk assessments.
Recommended Actions
- Apply the ConnectWise‑provided patch immediately.
- Review and harden authentication configurations: enforce multi‑factor authentication for all ScreenConnect users and validate ViewState integrity settings.
- Enable detailed logging of authentication events and retain logs for at least 90 days to provide audit evidence.
- Update your asset inventory and control‑mapping repository to reflect the patched version.
- Conduct a focused control‑assessment run against the “authentication and access control” objective to capture evidence for compliance frameworks.
Source: CISA KEV – CVE‑2025‑3935