Attackers breached ConnectWise, compromised customer ScreenConnect instances
Vulnerabilities mentioned
All| CVE | Vulnerability | CVSS | EPSS | Signals | Published |
|---|---|---|---|---|---|
| CVE-2025-30406 | Hard-coded machineKey enables unauthenticated deserialization RCE in Gladinet CentreStack and Triofox | 9.8 | 94% | KEV | KEV |
| CVE-2025-3935 | ViewState Code Injection in ConnectWise ScreenConnect May Lead to RCE | 7.2 | 4% | KEV | KEV |
From the original article
3 min read at helpnetsecurity.com
A suspected “sophisticated nation state actor” has compromised ScreenConnect cloud instances of a “very small number” of ConnectWise customers, the company has revealed on Wednesday. “We have not observed any additional suspicious activity in ScreenConnect cloud instances since the patch was released on April 24,” they added on Friday.
By @zeljkazorz · helpnetsecurity.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.