{"cveID":"CVE-2025-3935","vendorProject":"ConnectWise","product":"ScreenConnect","vulnerabilityName":"ConnectWise ScreenConnect Improper Authentication Vulnerability","dateAdded":"2025-06-02","shortDescription":"ConnectWise ScreenConnect contains an improper authentication vulnerability. This vulnerability could allow a ViewState code injection attack, which could allow remote code execution if machine keys are compromised.","requiredAction":"Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.","dueDate":"2025-06-23","knownRansomwareCampaignUse":"Unknown","notes":"https://www.connectwise.com/company/trust/security-bulletins/screenconnect-security-patch-2025.4 ;   https://nvd.nist.gov/vuln/detail/CVE-2025-3935","cwes":["CWE-287"],"year":2025,"state":"mapped","stale_reasons":[],"mappings":[{"domain":"enterprise","cve":"CVE-2025-3935","technique":"T1203","technique_name_at_mapping":"Exploitation for Client Execution","mapping_type":"exploitation_technique","capability_group":"access_ctrl","comments":"By exploiting this vulnerability, which stems from ASP.NET and its use of ViewState, an attacker with privileged access can gain access to sensitive data, such as machine keys. By using these machine keys, the attacker can craft malicious ViewState payloads to execute remote code on the ScreenConnect server.","references":["https://censys.com/advisory/cve-2025-3935"],"status":"complete","source_file":"kev-07.28.2025_attack-16.1-enterprise.json","attack_version":"16.1","kev_snapshot":"07/28/2025"},{"domain":"enterprise","cve":"CVE-2025-3935","technique":"T1059","technique_name_at_mapping":"Command and Scripting Interpreter","mapping_type":"primary_impact","capability_group":"access_ctrl","comments":"By exploiting this vulnerability, which stems from ASP.NET and its use of ViewState, an attacker with privileged access can gain access to sensitive data, such as machine keys. By using these machine keys, the attacker can craft malicious ViewState payloads to execute remote code on the ScreenConnect server.","references":["https://censys.com/advisory/cve-2025-3935"],"status":"complete","source_file":"kev-07.28.2025_attack-16.1-enterprise.json","attack_version":"16.1","kev_snapshot":"07/28/2025"}],"techniques":[{"id":"T1059","domains":["enterprise"],"in_current_bundle":true,"live":true,"name_now":"Command and Scripting Interpreter","name_at_mapping":"Command and Scripting Interpreter","renamed":false,"revoked_by":null,"mapping_types":["primary_impact"],"sigma_rule_count":95,"has_detection_strategy":true},{"id":"T1203","domains":["enterprise"],"in_current_bundle":true,"live":true,"name_now":"Exploitation for Client Execution","name_at_mapping":"Exploitation for Client Execution","renamed":false,"revoked_by":null,"mapping_types":["exploitation_technique"],"sigma_rule_count":35,"has_detection_strategy":true}],"mapping_types":["exploitation_technique","primary_impact"],"has_exploitation_technique":true,"mapping_attack_versions":["16.1"],"mapping_domains":["enterprise"],"sigma_coverage":"full","sigma_rules_tagged_cve":[],"added_after_mapping_snapshot":false,"_source":"kevmap","_built":"2026-08-23 05:47 UTC","_attack_version":"19.2"}