CVE-2025-14265

In versions of ScreenConnect™ prior to 25.8, server-side validation and integrity checks within the extension subsystem could allow the installation and execution of untrusted or arbitrary extensions by authorized or administrative users. Abuse of this behavior could result in the execution of custom code on the server or unauthorized access to application configuration data. This issue affects only the ScreenConnect server component; host and guest clients are not impacted. ScreenConnect 25.8 introduces enhanced server-side configuration handling and integrity checks to ensure only trusted extensions can be installed.

CVSS v3 9.1 CRITICAL

9.1^/10

CVSS v3 : CRITICAL

Vector :

Exploitability : 2.3 / Impact : 6.0

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required HIGH

User Interaction NONE

Confidentiality Impact HIGH

Integrity Impact HIGH

Availability Impact HIGH

Scope CHANGED

References

Link	Resource
https://www.connectwise.com/company/trust/security-bulletins/screenconnect-2025.8-security-patch	Vendor Advisory

Configurations

Configuration 1 (hide)

cpe:2.3:a:connectwise:screenconnect:*:*:*:*:*:*:*:*

History

07 Oct 2026, 20:10

Type	Values Removed	Values Added
Summary		(es) En versiones de ScreenConnect™ anteriores a la 25.8, la validación del lado del servidor y las comprobaciones de integridad dentro del subsistema de extensiones podrían permitir la instalación y ejecución de extensiones no confiables o arbitrarias por parte de usuarios autorizados o administrativos. El abuso de este comportamiento podría resultar en la ejecución de código personalizado en el servidor o acceso no autorizado a datos de configuración de la aplicación. Este problema afecta solo al componente de servidor de ScreenConnect; los clientes anfitrión y invitado no se ven afectados. ScreenConnect 25.8 introduce un manejo mejorado de la configuración del lado del servidor y comprobaciones de integridad para asegurar que solo se puedan instalar extensiones confiables.

Information

Published : 2025-12-11 15:15

Updated : 2026-10-07 20:10

NVD link : CVE-2025-14265

Mitre link : CVE-2025-14265

CVE.ORG link : CVE-2025-14265

JSON object : View

Products Affected

connectwise

screenconnect

CWE

CWE-494

Download of Code Without Integrity Check

{"id": "CVE-2025-14265", "cveTags": [], "metrics": {"ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2025-14265", "role": "CISA Coordinator", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "total"}], "version": "2.0.3", "timestamp": "2025-12-12T04:55:51.377077Z"}}], "cvssMetricV31": [{"type": "Secondary", "source": "7d616e1a-3288-43b1-a0dd-0a65d3e70a49", "cvssData": {"scope": "CHANGED", "version": "3.1", "baseScore": 9.1, "attackVector": "NETWORK", "baseSeverity": "CRITICAL", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "HIGH", "confidentialityImpact": "HIGH"}, "impactScore": 6.0, "exploitabilityScore": 2.3}]}, "affected": [{"source": "7d616e1a-3288-43b1-a0dd-0a65d3e70a49", "affectedData": [{"vendor": "ConnectWise", "modules": ["Web Application Server"], "product": "ScreenConnect", "versions": [{"status": "affected", "version": "All versions prior to 2025.8"}], "defaultStatus": "unaffected"}]}], "published": "2025-12-11T15:15:46.863", "references": [{"url": "https://www.connectwise.com/company/trust/security-bulletins/screenconnect-2025.8-security-patch", "tags": ["Vendor Advisory"], "source": "7d616e1a-3288-43b1-a0dd-0a65d3e70a49"}], "vulnStatus": "Analyzed", "weaknesses": [{"type": "Secondary", "source": "7d616e1a-3288-43b1-a0dd-0a65d3e70a49", "description": [{"lang": "en", "value": "CWE-494"}]}], "descriptions": [{"lang": "en", "value": "In versions of ScreenConnect\u2122 prior to 25.8, server-side validation and integrity checks within the extension subsystem could allow the installation and execution of untrusted or arbitrary extensions by authorized or administrative users. Abuse of this behavior could result in the execution of custom code on the server or unauthorized access to application configuration data. This issue affects only the ScreenConnect server component; host and guest clients are not impacted. ScreenConnect 25.8 introduces enhanced server-side configuration handling and integrity checks to ensure only trusted extensions can be installed."}, {"lang": "es", "value": "En versiones de ScreenConnect\u2122 anteriores a la 25.8, la validaci\u00f3n del lado del servidor y las comprobaciones de integridad dentro del subsistema de extensiones podr\u00edan permitir la instalaci\u00f3n y ejecuci\u00f3n de extensiones no confiables o arbitrarias por parte de usuarios autorizados o administrativos. El abuso de este comportamiento podr\u00eda resultar en la ejecuci\u00f3n de c\u00f3digo personalizado en el servidor o acceso no autorizado a datos de configuraci\u00f3n de la aplicaci\u00f3n. Este problema afecta solo al componente de servidor de ScreenConnect; los clientes anfitri\u00f3n y invitado no se ven afectados. ScreenConnect 25.8 introduce un manejo mejorado de la configuraci\u00f3n del lado del servidor y comprobaciones de integridad para asegurar que solo se puedan instalar extensiones confiables."}], "lastModified": "2026-10-07T20:10:01.970", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:connectwise:screenconnect:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "19C5783B-C6B5-4181-80A0-082DF09B007B", "versionEndExcluding": "25.8.0.9438"}], "operator": "OR"}]}], "sourceIdentifier": "7d616e1a-3288-43b1-a0dd-0a65d3e70a49"}