CVE-2025-14265 (GCVE-0-2025-14265)

Vulnerability from cvelistv5 – Published: 2025-12-11 14:21 – Updated: 2025-12-12 04:55
VLAI?
Summary
In versions of ScreenConnect™ prior to 25.8, server-side validation and integrity checks within the extension subsystem could allow the installation and execution of untrusted or arbitrary extensions by authorized or administrative users. Abuse of this behavior could result in the execution of custom code on the server or unauthorized access to application configuration data. This issue affects only the ScreenConnect server component; host and guest clients are not impacted. ScreenConnect 25.8 introduces enhanced server-side configuration handling and integrity checks to ensure only trusted extensions can be installed.
Severity ?
9.1 (Critical)
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H
CWE
  • CWE-494 - Download of Code Without Integrity Check
Assigner
References
Impacted products
Vendor Product Version
ConnectWise ScreenConnect Affected: All versions prior to 2025.8
Create a notification for this product.
Credits
Paul Whiting (Ultraviolet Cyber)
Show details on NVD website
To clipboard 

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2025-14265",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "total"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2025-12-11T00:00:00+00:00",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2025-12-12T04:55:50.632Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "modules": [
            "Web Application Server"
          ],
          "product": "ScreenConnect",
          "vendor": "ConnectWise",
          "versions": [
            {
              "status": "affected",
              "version": "All versions prior to 2025.8"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "value": "Paul Whiting (Ultraviolet Cyber)"
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "In versions of ScreenConnect\u2122 prior to 25.8, server-side validation and integrity checks within the extension subsystem could allow the installation and execution of untrusted or arbitrary extensions by authorized or administrative users. Abuse of this behavior could result in the execution of custom code on the server or unauthorized access to application configuration data. This issue affects only the ScreenConnect server component; host and guest clients are not impacted. ScreenConnect 25.8 introduces enhanced server-side configuration handling and integrity checks to ensure only trusted extensions can be installed.\u003cbr\u003e"
            }
          ],
          "value": "In versions of ScreenConnect\u2122 prior to 25.8, server-side validation and integrity checks within the extension subsystem could allow the installation and execution of untrusted or arbitrary extensions by authorized or administrative users. Abuse of this behavior could result in the execution of custom code on the server or unauthorized access to application configuration data. This issue affects only the ScreenConnect server component; host and guest clients are not impacted. ScreenConnect 25.8 introduces enhanced server-side configuration handling and integrity checks to ensure only trusted extensions can be installed."
        }
      ],
      "impacts": [
        {
          "capecId": "CAPEC-137",
          "descriptions": [
            {
              "lang": "en",
              "value": "CAPEC-137 Parameter Injection"
            }
          ]
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 9.1,
            "baseSeverity": "CRITICAL",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "HIGH",
            "privilegesRequired": "HIGH",
            "scope": "CHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H",
            "version": "3.1"
          },
          "format": "CVSS",
          "scenarios": [
            {
              "lang": "en",
              "value": "GENERAL"
            }
          ]
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-494",
              "description": "CWE-494 Download of Code Without Integrity Check",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2025-12-11T21:19:13.087Z",
        "orgId": "7d616e1a-3288-43b1-a0dd-0a65d3e70a49",
        "shortName": "ConnectWise"
      },
      "references": [
        {
          "url": "https://www.connectwise.com/company/trust/security-bulletins/screenconnect-2025.8-security-patch"
        }
      ],
      "solutions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "\u003cbr\u003e\u003cp\u003e\u003cb\u003eCloud:\u0026nbsp;\u003c/b\u003eNo action is required. ScreenConnect servers hosted in\n\u201cscreenconnect.com\u201d cloud (standalone and Automate/RMM integrated) or\n\u201chostedrmm.com\u201d for Automate partners have been updated to remediate the\nissue.\u202f\u0026nbsp;\u0026nbsp;\u003c/p\u003e\n\n\n\n\n\n\u003cp\u003e\u003cb\u003eOn-prem:\u003c/b\u003e\u003c/p\u003e\n\n\u003cp\u003e\u003c/p\u003e\u003cul\u003e\u003cli\u003e\u003ca target=\"_blank\" rel=\"nofollow\"\u003e\u003cb\u003eScreenConnect\u003c/b\u003e \u003cb\u003ePartners:\u0026nbsp;\u003c/b\u003e\u003c/a\u003ePlease upgrade to ScreenConnect version 25.8 and update\nyour guest clients to the same version. Visit \u003ca target=\"_blank\" rel=\"nofollow\" href=\"https://order.screenconnect.com/Create-Order\"\u003eDownload\n| ScreenConnect\u003c/a\u003e page to download and apply the update \u003ci\u003e(access\nrequires a valid on-premises license)\u003c/i\u003e.\u0026nbsp;\u003c/li\u003e\u003cli\u003e\u003ca target=\"_blank\" rel=\"nofollow\"\u003e\u003cb\u003eAutomate On-Prem Partners with\nScreenConnect Integration\u003c/b\u003e:\u0026nbsp;\u003c/a\u003e\n\nPartners using an on-premises ScreenConnect installation integrated with Automate must ensure that the Automate ScreenConnect Extension is updated to version 4.4.0.16 before upgrading the ScreenConnect server to version 25.8. Once confirmed, visit the \n\n\u003ca target=\"_blank\" rel=\"nofollow\" href=\"https://docs.connectwise.com/ConnectWise_Automate_Documentation/Automate_Product_Updates\"\u003eAutomate Product Updates\u003c/a\u003e \n\n page to download and apply the ScreenConnect 25.8 update.\u003cbr\u003e\u003c/li\u003e\u003c/ul\u003e\u003ca target=\"_blank\" rel=\"nofollow\"\u003e\u003c/a\u003e\u003cp\u003e\u003c/p\u003e\n\n\n\n\n\n\n\n\n\n\u003cdiv\u003e\n\n\n\n\n\n\u003cdiv\u003e\n\n\n\n\u003cp\u003e\u003cbr\u003e\u003c/p\u003e\u003c/div\u003e\u003c/div\u003e"
            }
          ],
          "value": "Cloud:\u00a0No action is required. ScreenConnect servers hosted in\n\u201cscreenconnect.com\u201d cloud (standalone and Automate/RMM integrated) or\n\u201chostedrmm.com\u201d for Automate partners have been updated to remediate the\nissue.\u202f\u00a0\u00a0\n\n\n\n\n\n\n\nOn-prem:\n\n\n\n\n\n  *  ScreenConnect Partners:\u00a0Please upgrade to ScreenConnect version 25.8 and update\nyour guest clients to the same version. Visit Download\n| ScreenConnect page to download and apply the update (access\nrequires a valid on-premises license).\u00a0\n  *  Automate On-Prem Partners with\nScreenConnect Integration:\u00a0\n\nPartners using an on-premises ScreenConnect installation integrated with Automate must ensure that the Automate ScreenConnect Extension is updated to version 4.4.0.16 before upgrading the ScreenConnect server to version 25.8. Once confirmed, visit the \n\n Automate Product Updates https://docs.connectwise.com/ConnectWise_Automate_Documentation/Automate_Product_Updates  \n\n page to download and apply the ScreenConnect 25.8 update."
        }
      ],
      "source": {
        "discovery": "UNKNOWN"
      },
      "title": "Improper server-side validation in ScreenConnect extension framework",
      "x_generator": {
        "engine": "Vulnogram 0.5.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "7d616e1a-3288-43b1-a0dd-0a65d3e70a49",
    "assignerShortName": "ConnectWise",
    "cveId": "CVE-2025-14265",
    "datePublished": "2025-12-11T14:21:53.234Z",
    "dateReserved": "2025-12-08T12:25:20.291Z",
    "dateUpdated": "2025-12-12T04:55:50.632Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2",
  "vulnerability-lookup:meta": {
    "nvd": "{\"cve\":{\"id\":\"CVE-2025-14265\",\"sourceIdentifier\":\"7d616e1a-3288-43b1-a0dd-0a65d3e70a49\",\"published\":\"2025-12-11T15:15:46.863\",\"lastModified\":\"2025-12-12T15:18:13.390\",\"vulnStatus\":\"Awaiting Analysis\",\"cveTags\":[],\"descriptions\":[{\"lang\":\"en\",\"value\":\"In versions of ScreenConnect\u2122 prior to 25.8, server-side validation and integrity checks within the extension subsystem could allow the installation and execution of untrusted or arbitrary extensions by authorized or administrative users. Abuse of this behavior could result in the execution of custom code on the server or unauthorized access to application configuration data. This issue affects only the ScreenConnect server component; host and guest clients are not impacted. ScreenConnect 25.8 introduces enhanced server-side configuration handling and integrity checks to ensure only trusted extensions can be installed.\"}],\"metrics\":{\"cvssMetricV31\":[{\"source\":\"7d616e1a-3288-43b1-a0dd-0a65d3e70a49\",\"type\":\"Secondary\",\"cvssData\":{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H\",\"baseScore\":9.1,\"baseSeverity\":\"CRITICAL\",\"attackVector\":\"NETWORK\",\"attackComplexity\":\"LOW\",\"privilegesRequired\":\"HIGH\",\"userInteraction\":\"NONE\",\"scope\":\"CHANGED\",\"confidentialityImpact\":\"HIGH\",\"integrityImpact\":\"HIGH\",\"availabilityImpact\":\"HIGH\"},\"exploitabilityScore\":2.3,\"impactScore\":6.0}]},\"weaknesses\":[{\"source\":\"7d616e1a-3288-43b1-a0dd-0a65d3e70a49\",\"type\":\"Secondary\",\"description\":[{\"lang\":\"en\",\"value\":\"CWE-494\"}]}],\"references\":[{\"url\":\"https://www.connectwise.com/company/trust/security-bulletins/screenconnect-2025.8-security-patch\",\"source\":\"7d616e1a-3288-43b1-a0dd-0a65d3e70a49\"}]}}",
    "vulnrichment": {
      "containers": "{\"adp\": [{\"title\": \"CISA ADP Vulnrichment\", \"metrics\": [{\"other\": {\"type\": \"ssvc\", \"content\": {\"id\": \"CVE-2025-14265\", \"role\": \"CISA Coordinator\", \"options\": [{\"Exploitation\": \"none\"}, {\"Automatable\": \"yes\"}, {\"Technical Impact\": \"partial\"}], \"version\": \"2.0.3\", \"timestamp\": \"2025-12-11T14:43:15.420860Z\"}}}], \"providerMetadata\": {\"orgId\": \"134c704f-9b21-4f2e-91b3-4a467353bcc0\", \"shortName\": \"CISA-ADP\", \"dateUpdated\": \"2025-12-11T14:43:51.951Z\"}}], \"cna\": {\"title\": \"Improper server-side validation in ScreenConnect extension framework\", \"source\": {\"discovery\": \"UNKNOWN\"}, \"credits\": [{\"lang\": \"en\", \"type\": \"finder\", \"value\": \"Paul Whiting (Ultraviolet Cyber)\"}], \"impacts\": [{\"capecId\": \"CAPEC-137\", \"descriptions\": [{\"lang\": \"en\", \"value\": \"CAPEC-137 Parameter Injection\"}]}], \"metrics\": [{\"format\": \"CVSS\", \"cvssV3_1\": {\"scope\": \"CHANGED\", \"version\": \"3.1\", \"baseScore\": 9.1, \"attackVector\": \"NETWORK\", \"baseSeverity\": \"CRITICAL\", \"vectorString\": \"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H\", \"integrityImpact\": \"HIGH\", \"userInteraction\": \"NONE\", \"attackComplexity\": \"LOW\", \"availabilityImpact\": \"HIGH\", \"privilegesRequired\": \"HIGH\", \"confidentialityImpact\": \"HIGH\"}, \"scenarios\": [{\"lang\": \"en\", \"value\": \"GENERAL\"}]}], \"affected\": [{\"vendor\": \"ConnectWise\", \"modules\": [\"Web Application Server\"], \"product\": \"ScreenConnect\", \"versions\": [{\"status\": \"affected\", \"version\": \"All versions prior to 2025.8\"}], \"defaultStatus\": \"unaffected\"}], \"solutions\": [{\"lang\": \"en\", \"value\": \"Cloud:\\u00a0No action is required. ScreenConnect servers hosted in\\n\\u201cscreenconnect.com\\u201d cloud (standalone and Automate/RMM integrated) or\\n\\u201chostedrmm.com\\u201d for Automate partners have been updated to remediate the\\nissue.\\u202f\\u00a0\\u00a0\\n\\n\\n\\n\\n\\n\\n\\nOn-prem:\\n\\n\\n\\n\\n\\n  *  ScreenConnect Partners:\\u00a0Please upgrade to ScreenConnect version 25.8 and update\\nyour guest clients to the same version. Visit Download\\n| ScreenConnect page to download and apply the update (access\\nrequires a valid on-premises license).\\u00a0\\n  *  Automate On-Prem Partners with\\nScreenConnect Integration:\\u00a0\\n\\nPartners using an on-premises ScreenConnect installation integrated with Automate must ensure that the Automate ScreenConnect Extension is updated to version 4.4.0.16 before upgrading the ScreenConnect server to version 25.8. Once confirmed, visit the \\n\\n Automate Product Updates https://docs.connectwise.com/ConnectWise_Automate_Documentation/Automate_Product_Updates  \\n\\n page to download and apply the ScreenConnect 25.8 update.\", \"supportingMedia\": [{\"type\": \"text/html\", \"value\": \"\u003cbr\u003e\u003cp\u003e\u003cb\u003eCloud:\u0026nbsp;\u003c/b\u003eNo action is required. ScreenConnect servers hosted in\\n\\u201cscreenconnect.com\\u201d cloud (standalone and Automate/RMM integrated) or\\n\\u201chostedrmm.com\\u201d for Automate partners have been updated to remediate the\\nissue.\\u202f\u0026nbsp;\u0026nbsp;\u003c/p\u003e\\n\\n\\n\\n\\n\\n\u003cp\u003e\u003cb\u003eOn-prem:\u003c/b\u003e\u003c/p\u003e\\n\\n\u003cp\u003e\u003c/p\u003e\u003cul\u003e\u003cli\u003e\u003ca target=\\\"_blank\\\" rel=\\\"nofollow\\\"\u003e\u003cb\u003eScreenConnect\u003c/b\u003e \u003cb\u003ePartners:\u0026nbsp;\u003c/b\u003e\u003c/a\u003ePlease upgrade to ScreenConnect version 25.8 and update\\nyour guest clients to the same version. Visit \u003ca target=\\\"_blank\\\" rel=\\\"nofollow\\\" href=\\\"https://order.screenconnect.com/Create-Order\\\"\u003eDownload\\n| ScreenConnect\u003c/a\u003e page to download and apply the update \u003ci\u003e(access\\nrequires a valid on-premises license)\u003c/i\u003e.\u0026nbsp;\u003c/li\u003e\u003cli\u003e\u003ca target=\\\"_blank\\\" rel=\\\"nofollow\\\"\u003e\u003cb\u003eAutomate On-Prem Partners with\\nScreenConnect Integration\u003c/b\u003e:\u0026nbsp;\u003c/a\u003e\\n\\nPartners using an on-premises ScreenConnect installation integrated with Automate must ensure that the Automate ScreenConnect Extension is updated to version 4.4.0.16 before upgrading the ScreenConnect server to version 25.8. Once confirmed, visit the \\n\\n\u003ca target=\\\"_blank\\\" rel=\\\"nofollow\\\" href=\\\"https://docs.connectwise.com/ConnectWise_Automate_Documentation/Automate_Product_Updates\\\"\u003eAutomate Product Updates\u003c/a\u003e \\n\\n page to download and apply the ScreenConnect 25.8 update.\u003cbr\u003e\u003c/li\u003e\u003c/ul\u003e\u003ca target=\\\"_blank\\\" rel=\\\"nofollow\\\"\u003e\u003c/a\u003e\u003cp\u003e\u003c/p\u003e\\n\\n\\n\\n\\n\\n\\n\\n\\n\\n\u003cdiv\u003e\\n\\n\\n\\n\\n\\n\u003cdiv\u003e\\n\\n\\n\\n\u003cp\u003e\u003cbr\u003e\u003c/p\u003e\u003c/div\u003e\u003c/div\u003e\", \"base64\": false}]}], \"references\": [{\"url\": \"https://www.connectwise.com/company/trust/security-bulletins/screenconnect-2025.8-security-patch\"}], \"x_generator\": {\"engine\": \"Vulnogram 0.5.0\"}, \"descriptions\": [{\"lang\": \"en\", \"value\": \"In versions of ScreenConnect\\u2122 prior to 25.8, server-side validation and integrity checks within the extension subsystem could allow the installation and execution of untrusted or arbitrary extensions by authorized or administrative users. Abuse of this behavior could result in the execution of custom code on the server or unauthorized access to application configuration data. This issue affects only the ScreenConnect server component; host and guest clients are not impacted. ScreenConnect 25.8 introduces enhanced server-side configuration handling and integrity checks to ensure only trusted extensions can be installed.\", \"supportingMedia\": [{\"type\": \"text/html\", \"value\": \"In versions of ScreenConnect\\u2122 prior to 25.8, server-side validation and integrity checks within the extension subsystem could allow the installation and execution of untrusted or arbitrary extensions by authorized or administrative users. Abuse of this behavior could result in the execution of custom code on the server or unauthorized access to application configuration data. This issue affects only the ScreenConnect server component; host and guest clients are not impacted. ScreenConnect 25.8 introduces enhanced server-side configuration handling and integrity checks to ensure only trusted extensions can be installed.\u003cbr\u003e\", \"base64\": false}]}], \"problemTypes\": [{\"descriptions\": [{\"lang\": \"en\", \"type\": \"CWE\", \"cweId\": \"CWE-494\", \"description\": \"CWE-494 Download of Code Without Integrity Check\"}]}], \"providerMetadata\": {\"orgId\": \"7d616e1a-3288-43b1-a0dd-0a65d3e70a49\", \"shortName\": \"ConnectWise\", \"dateUpdated\": \"2025-12-11T21:19:13.087Z\"}}}",
      "cveMetadata": "{\"cveId\": \"CVE-2025-14265\", \"state\": \"PUBLISHED\", \"dateUpdated\": \"2025-12-11T21:19:13.087Z\", \"dateReserved\": \"2025-12-08T12:25:20.291Z\", \"assignerOrgId\": \"7d616e1a-3288-43b1-a0dd-0a65d3e70a49\", \"datePublished\": \"2025-12-11T14:21:53.234Z\", \"assignerShortName\": \"ConnectWise\"}",
      "dataType": "CVE_RECORD",
      "dataVersion": "5.2"
    }
  }
}


Log in or create an account to share your comment.




Tags
Taxonomy of the tags.




Sightings

Author Source Type Date

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.



Detection rules are retrieved from Rulezet.