Attackers breached ConnectWise, compromised customer ScreenConnect instances
Vulnerabilities mentionedAll →
| CVE | Vulnerability | CVSS | EPSS | Flags | Affected | Exposure | Published |
|---|---|---|---|---|---|---|---|
| CVE-2025-30406 | Hard-coded machineKey enables unauthenticated deserialization RCE in Gladinet CentreStack and Triofox Gladinet CentreStack (and, per CISA, the companion product Triofox) ships with a hard-coded ASP.NET machineKey in the portal's web.config, which is used to protect ViewState and similar serialized data. An attacker who knows this fixed key can craft a serialized payload and submit it to the network-facing portal, where server-side deserialization executes it, yielding unauthenticated remote code execution (CVSS 9.8, no privileges or user interaction required). Successful RCE gives attackers full control of the file-sharing server (high confidentiality, integrity and availability impact); public reporting indicates attackers have abused the flaw to gain unauthorized access and install remote access tools. Anyone running the affected CentreStack builds is exposed, with self-hosted deployments at SMBs and MSP-hosted environments the typical footprint. The flaw was exploited in the wild in March 2025, was added to CISA's Known Exploited Vulnerabilities catalog on 2025-04-08, and carries an EPSS of 94.3% (100th percentile). Do: Upgrade CentreStack to 16.4.10315.56368 or later, and apply the equivalent vendor fix for Triofox; as an interim mitigation, administrators can delete the hard-coded machineKey defined in portal\web.config so it is regenerated. Because the flaw is actively exploited, review portals for signs of compromise (unexpected accounts, unfamiliar processes or remote access tools) and, for federal agencies, follow the applicable BOD 22-01 required actions. | 9.8 | 94% | KEV |
| moderateon the order of thousands of internet-exposed instances (self-hosted file-sharing/MFT portals, largely at SMBs and MSPs); no public install counts in the… | |
| CVE-2025-3935 | ViewState Code Injection in ConnectWise ScreenConnect May Lead to RCE ConnectWise ScreenConnect versions 25.2.3 and earlier rely on ASP.NET Web Forms ViewState, whose integrity depends on machine keys; if an attacker with privileged system-level access obtains those keys, they can craft and send a malicious ViewState that the server deserializes, potentially resulting in remote code execution. The risk stems from platform-level ASP.NET behavior rather than a defect introduced by ScreenConnect, and the ScreenConnect Client is not directly impacted, though the CVSS vector (PR:H) confirms exploitation requires already having high privileges on the host. An attacker who achieves this gains code execution on the server with the confidentiality, integrity, and availability impact reflected in the 7.2 High score. ScreenConnect 2025.4 mitigates the issue by disabling ViewState entirely and removing any dependency on it. The flaw was added to CISA's Known Exploited Vulnerabilities catalog on 2025-06-02, indicating confirmed exploitation in the wild, with EPSS estimating a 3.4% chance of exploitation in the next 30 days (88th percentile). Do: Upgrade to ScreenConnect 2025.4, which disables ViewState and removes any dependency on it, per vendor instructions and CISA BOD 22-01 requirements; if an upgrade is not immediately possible, apply vendor mitigations or discontinue use of the affected product. Because exploitation requires compromised machine keys, administrators who suspect prior privileged compromise should also review and rotate ASP.NET machine keys and investigate for signs of system-level access. Note ConnectWise is separately rotating ScreenConnect code signing certificates following a nation-state intrusion, so check vendor advisories for related hardening steps. | 7.2 | 3% | KEV |
| largetens of thousands of internet-exposed ScreenConnect servers (≈40,000+ in public scans), serving millions of managed endpoints |
Indicators of compromiseauto-extracted · verify before use · export allAll →
| Type | Indicator | Context |
|---|---|---|
| domain | asp.net | STATE hidden field. To protect this data against tampering, ASP.NET employs machine keys. But if attackers get their hands on t |
Full article603 words · extracted from helpnetsecurity.com · click to collapse
A suspected “sophisticated nation state actor” has compromised ScreenConnect cloud instances of a “very small number” of ConnectWise customers, the company has revealed on Wednesday.
“We have not observed any additional suspicious activity in ScreenConnect cloud instances since the patch was released on April 24,” they added on Friday.
The patch in question fixes CVE-2025-3935, a ViewState deserialization vulnerability affecting ScreenConnect versions 25.2.3 and earlier, which can allow attackers to inject malicious code and achieve unauthenticated remote code execution on the underlying server.
What happened?
ConnectWise is a Florida-based company that develops a software solutions tailored for managed service providers (MSPs), IT departments, and technology solution providers (TSPs).
ScreenConnect is the company’s popular remote support/access offering, which can be hosted by ConnectWise on their cloud infrastructure or self-hosted by organizations on their own dedicated physical or virtual infrastructure or in their private cloud.
ConnectWise mentioned suspicious activity within their environment, which points to customer instances hosted by ConnectWise having been compromised – apparently before the April 24 patch (for CVE-2025-3935) was deployed.
The company’s initial security event advisory was short, and the Frequently Asked Questions (FAQ) section added on Friday failed to provide more clarity about how the compromise happened.
ConnectWise confirmed that Mandiant’s forensic experts are helping them investigate the intrusion. We’ve reached out to ConnectWise for more information, but they simply pointed us to the sparse advisory.
“Our investigation is ongoing, and we will share additional information as we are able,” the company said.
About CVE-2025-3935
ScreenConnect is built using ASP.NET, a web framework developed by Microsoft for building web applications and services.
ASP.NET Web Forms uses ViewState to remember the state of a web page between visits, and it does so by converting the relevant data to a string, encoding with Base64, and putting it in the web page’s __VIEWSTATE hidden field. To protect this data against tampering, ASP.NET employs machine keys.
But if attackers get their hands on these keys, they can craft a malicious ViewState and send it via a POST request to the website. The website will think the data is safe and will run it, thus allowing attackers to remotely execute potentially malicious code on the website’s server.
The success of the attack thus hinges on the attackers attaining privileged access to extract the machine keys and, of course, on them knowing how to exploit the deserialization flaw.
ConnectWise’s developers have mitigated this risk by pushing out the ScreenConnect 2025.4 patch, which disables ViewState and removes any dependency on it.
Unfortunately, it seems that attackers have managed to exploit this vulnerability before the patch has been implemented: according to a (professed) affected customer’s complaint on Reddit, the compromise of their instance occurred in November 2024.
The vulnerability, as it affects ScreenConnect, has been labeled CVE-2025-3935, though the issue effectively impacts any product using ASP.NET framework / ViewState, the ConnectWise pointed out.
A similar vulnerability has also been exploited by attackers to compromise Gladinet’s CentreStack and Triofox file sharing and remote access platforms: CVE-2025-30406 stemmed from hardcoded machine keys that allowed attackers to successfully forge ViewState data.
Financially motivated threat actors and government-backed attackers have notoriously exploited a ScreenConnect vulnerability last year, but ConnectWise says that this latest attack is not related to it.
“[This recently discovered] suspicious activity has been tied to a nation state threat actor that is known for intelligence collection,” the company shared.
UPDATE (June 4, 2025, 04:05 a.m. ET):
CISA has added CVE-2025-3935 to its Known Exploited Vulnerabilities catalog.
Subscribe to our breaking news e-mail alert to never miss out on the latest breaches, vulnerabilities and cybersecurity threats. Subscribe here!
Text extracted automatically; images, tables and formatting may be missing. Original: https://www.helpnetsecurity.com/2025/06/02/attackers-breached-connectwise-compromised-customer-screenconnect-instances/