ScreenConnect Exposure to ASP.NET ViewState Code Injection (CVE-2025-3935)

What is affected, what to do

ScreenConnect versions 25.2.3 and earlier versions may be susceptible to a ViewState code injection attack. ASP.NET Web Forms use ViewState to preserve page and control state, with data encoded using Base64 protected by machine keys.

The vulnerability is being actively exploited; treat it as a priority. Update ConnectWise ScreenConnect to version 25.2.3. Immediate actions, mitigation and detection rules are in the runbook below.

Affected

• ConnectWise ScreenConnect lt *..25.2.3

Fixed in

• ConnectWise ScreenConnect 25.2.3

Not sure whether and how you are affected? Ask a question about this vulnerability

Metrics

Response and mitigation

1. 01

   Runbook step 1

   Immediate response (0-24 h)

   • Inventory: Identify every self-hosted (on-prem) ScreenConnect server, including instances that MSPs run on your behalf. Versions 25.2.3 and earlier are affected. Per the vendor, ScreenConnect 2025.4 disables ViewState entirely and removes the dependency. Confirm the exact fixed build in the ConnectWise advisory, since the product list also references 25.2.3/25.2.4.
   • Upgrade: Move to 2025.4 or later. For cloud-hosted instances, get written confirmation of patch status from ConnectWise or your MSP (useful evidence for NIS2 supply-chain obligations).
   • Rotate machine keys: Regenerate the machineKey values (validationKey, decryptionKey) in the ScreenConnect web.config and restart the service. Do this even after upgrading if prior system-level access cannot be ruled out.
   • Assume prior compromise: Extracting the keys requires privileged system access, so treat the host as potentially compromised. Review local admins, service accounts, scheduled tasks and recently created ScreenConnect users.
   • Reset credentials: Reset passwords for all ScreenConnect admin accounts, enforce MFA, and revoke API/extension tokens.
   • Reduce exposure: Until patched, restrict the web UI (default TCP 8040) to VPN or an IP allowlist.
2. 02

   Runbook step 2

   Mitigation layers

   • Network segmentation: Host the server in a dedicated DMZ. Expose the relay port (default TCP 8041) only to clients. Restrict web admin access (8040) to admin networks or ZTNA. Apply default-deny egress from the server.
   • WAF/IPS: Alert on or block POSTs to .aspx endpoints that carry an oversized __VIEWSTATE parameter (e.g. > 10 KB) or that trigger repeated validation failures. After 2025.4, legitimate traffic should carry no __VIEWSTATE at all.
   • Endpoint hardening: Use EDR/ASR rules to block ScreenConnect.Service.exe on the server from spawning cmd.exe, powershell.exe, rundll32.exe, mshta.exe or certutil.exe. Add WDAC/AppLocker on the host.
   • Configuration protection: Lock the web.config ACL down to SYSTEM and the service account. Enable SACL read auditing and FIM on the file.
   • IAM/least privilege: Allow interactive logons only from PAWs or jump hosts. Use LAPS and minimise local admin rights. Never run the service under a domain admin account.
   • Supply chain: Contractually define patch SLAs and notification duties with MSPs that use ScreenConnect against your estate.
3. 03

   Runbook step 3

   Detection rules

   • Windows Application log, Event ID 1316 (ASP.NET event code 4009 "Viewstate verification failed"): Bursts on the ScreenConnect host indicate forged-ViewState probing. SPL: index=wineventlog EventCode=1316 host=<sc-server> | stats count by src_ip, _time span=10m
   • EDR process ancestry (Sysmon EID 1 / MDE): Look for shells launched directly by the web service on the server. KQL: DeviceProcessEvents | where InitiatingProcessFileName =~ "ScreenConnect.Service.exe" and FileName in~ ("cmd.exe","powershell.exe","rundll32.exe","mshta.exe","certutil.exe"). Scope this to server hosts, because ScreenConnect.ClientService.exe on endpoints is legitimate.
   • Key material access: Event ID 4663 or Sysmon EID 11 on *\ScreenConnect\web.config by any process other than the service itself, such as powershell.exe, findstr.exe or type. This is a strong indicator of key theft.
   • Web/proxy logs: External POSTs containing __VIEWSTATE against ScreenConnect pages, especially post-upgrade. Sigma shape: cs-method: POST AND cs-uri-query|contains: '__VIEWSTATE' AND sc-status: 500.
   • Network telemetry (Zeek/Suricata): New outbound connections from the server to unfamiliar destinations shortly after inbound web POSTs, which suggests beaconing or payload staging. Also watch for new files under App_Extensions or webshell-like .aspx/.ashx drops (Sysmon EID 11).

Detection rules

No NEOSEC detection rule is available for this vulnerability yet.

Classification under NIS2 and CRA

Rule-based classification from exploitation status and severity. It does not replace a case-by-case assessment.

NIS2

NIS2 is EU Directive (EU) 2022/2555 to raise the level of cybersecurity across the Union. It substantially broadens obligations compared with the first NIS directive: more sectors, mandatory risk management, staged reporting duties and personal accountability of senior management.

Read in glossary

Actively exploited: treat the vulnerability as a priority in vulnerability handling under Art. 21(2)(e) NIS2. If it is exploited in your environment, check the reporting obligation under Art. 23 (early warning within 24 hours).

CRA

The CRA is EU Regulation (EU) 2024/2847 setting horizontal cybersecurity requirements for „products with digital elements“ — from industrial controllers and software to connected consumer devices. For the first time manufacturers must ensure security across the entire product lifecycle, handle vulnerabilities and provide security updates.

Read in glossary

Since 11.09.2026, manufacturers of affected products with digital elements must report actively exploited vulnerabilities under Art. 14 CRA, with an early warning within 24 hours via ENISA's single reporting platform.

ISO/IEC 27001

ISO/IEC 27001 is the internationally leading standard for an information security management system (ISMS). It describes a risk-based, process-oriented framework to systematically plan, implement, review and improve information security.

Read in glossary

Control A.8.8, management of technical vulnerabilities: assess relevance to your systems, plan remediation and keep evidence.

Description

ScreenConnect versions 25.2.3 and earlier versions may be susceptible to a ViewState code injection attack. ASP.NET Web Forms use ViewState to preserve page and control state, with data encoded using Base64 protected by machine keys.  It is important to note that to obtain these machine keys, privileged system level access must be obtained. If these machine keys are compromised, attackers could create and send a malicious ViewState to the website, potentially leading to remote code execution on the server.  The risk does not originate from a vulnerability introduced by ScreenConnect, but from platform level behavior.  This had no direct impact to ScreenConnect Client. ScreenConnect 2025.4 patch disables ViewState and removes any dependency on it.

Source: NVD (NIST), cvelistv5, CISA KEV Catalog, CVE.org (MITRE), pwn.watch

Vendors and products

• ConnectWise ConnectWise ScreenConnect

Weakness classes (CWE)

• CWE-502Deserialization of Untrusted Data

  Base

  The product deserializes untrusted data without sufficiently ensuring that the resulting data will be valid.

  Entry at MITRE CWE-502

References & sources

• connectwise.comConnectWise advisory: ConnectWise ScreenConnectVendor advisory, pwn-watch
• connectwise.comcompany/trust/advisoriesVendor advisory
• cisa.govknown-exploited-vulnerabilities-catalog?field_cve=CVE-2025-3935government-resource, US government resource
• pwn.watchpwn.watch: ConnectWise ScreenConnect: ScreenConnect Improper Authentication Vulnerabilitypwn-watch
• NVD (NIST)NVD: CVE-2025-3935pwn-watch
• cisa.govCISA Known Exploited Vulnerabilities Catalogpwn-watch