ConnectWise to Rotate ScreenConnect Code Signing Certificates Due to Security Risks
Vulnerabilities mentionedAll →
| CVE | Vulnerability | CVSS | EPSS | Flags | Affected | Exposure | Published |
|---|---|---|---|---|---|---|---|
| CVE-2025-3935 | ViewState Code Injection in ConnectWise ScreenConnect May Lead to RCE ConnectWise ScreenConnect versions 25.2.3 and earlier rely on ASP.NET Web Forms ViewState, whose integrity depends on machine keys; if an attacker with privileged system-level access obtains those keys, they can craft and send a malicious ViewState that the server deserializes, potentially resulting in remote code execution. The risk stems from platform-level ASP.NET behavior rather than a defect introduced by ScreenConnect, and the ScreenConnect Client is not directly impacted, though the CVSS vector (PR:H) confirms exploitation requires already having high privileges on the host. An attacker who achieves this gains code execution on the server with the confidentiality, integrity, and availability impact reflected in the 7.2 High score. ScreenConnect 2025.4 mitigates the issue by disabling ViewState entirely and removing any dependency on it. The flaw was added to CISA's Known Exploited Vulnerabilities catalog on 2025-06-02, indicating confirmed exploitation in the wild, with EPSS estimating a 3.4% chance of exploitation in the next 30 days (88th percentile). Do: Upgrade to ScreenConnect 2025.4, which disables ViewState and removes any dependency on it, per vendor instructions and CISA BOD 22-01 requirements; if an upgrade is not immediately possible, apply vendor mitigations or discontinue use of the affected product. Because exploitation requires compromised machine keys, administrators who suspect prior privileged compromise should also review and rotate ASP.NET machine keys and investigate for signs of system-level access. Note ConnectWise is separately rotating ScreenConnect code signing certificates following a nation-state intrusion, so check vendor advisories for related hardening steps. | 7.2 | 3% | KEV |
| largetens of thousands of internet-exposed ScreenConnect servers (≈40,000+ in public scans), serving millions of managed endpoints |
Full article470 words · extracted from thehackernews.com · click to collapse
Ravie LakshmananJun 12, 2025Vulnerability / Software Security
ConnectWise has disclosed that it's planning to rotate the digital code signing certificates used to sign ScreenConnect, ConnectWise Automate, and ConnectWise remote monitoring and management (RMM) executables due to security concerns.
The company said it's doing so "due to concerns raised by a third-party researcher about how ScreenConnect handled certain configuration data in earlier versions."
While the company did not publicly elaborate on the nature of the problem, it has shed more light in a non-public FAQ accessible only to its customers (and later shared on Reddit) -
The concern stems from ScreenConnect using the ability to store configuration data in an available area of the installer that is not signed but is part of the installer. We are using this ability to pass down configuration information for the connection (between the agent and server) such as the URL where the agent should call back without invalidating the signature. The unsigned area is used by our software and others for customization, however, when coupled with the capabilities of a remote control solution, it could create an insecure design pattern by today's security standards.
Besides issuing new certificates, the company said it's releasing an update that's designed to improve how the aforementioned configuration data is managed in ScreenConnect.
The revocation of digital certificates is expected to take place by June 13 at 8 p.m. ET (June 14, 12 a.m. UTC). ConnectWise has emphasized that the issue does not involve a compromise of its systems or certificates.
It's worth noting that automatically ConnectWise is already in the process of updating certificates and agents across all its cloud instances of Automate and RMM.
However, those using on-premise versions of ScreenConnect or Automate are required to update to the latest build and validate that all agents are updated before the cutoff date to avoid any possible service disruptions.
"We had already planned enhancements to certificate management and product hardening, but these efforts are now being implemented on an accelerated timeline," ConnectWise said. "We understand this may create challenges and are committed to supporting you through the transition."
The development comes merely days after the company disclosed that a suspected nation-state threat actor breached its systems and affected a small number of its customers by exploiting CVE-2025-3935 to conduct ViewState code injection attacks.
It also comes as attackers are increasingly relying on legitimate RMM software like ScreenConnect and others to obtain stealthy, persistent remote access, effectively allowing them to blend in with normal activity and fly under the radar.
This attack methodology, called living-off-the-land (LotL), makes it possible to hijack the software's inherent capabilities for remote access, file transfer, and command execution.
Found this article interesting? Follow us on Google News, Twitter and LinkedIn to read more exclusive content we post.
Text extracted automatically; images, tables and formatting may be missing. Original: https://thehackernews.com/2025/06/connectwise-to-rotate-screenconnect.html