ConnectWise has released an urgent security patch for its ScreenConnect remote access software to address a serious vulnerability that could allow attackers to execute malicious code on affected systems. However, if these machine keys are compromised through privileged system-level access, attackers could craft and send malicious ViewState data to vulnerable ScreenConnect websites, potentially achieving remote code execution on the server. “It is crucial to understand that this issue could potentially impact any product utilizing ASP.NET framework ViewStates, and ScreenConnect is not an outlier,” ConnectWise stated in its security bulletin. “Microsoft has identified over 3,000 publicly disclosed keys that could be used for these types of attacks,” noted security researchers tracking the issue. ConnectWise has released ScreenConnect version 25.2.4 on April 24, 2025, which addresses the vulnerability by disabling ViewState and removing any dependency on it. For cloud-based users on the “screenconnect.com” platform (both standalone and integrated with Automate/RMM) or “hostedrmm.com” for Automate partners, no action is required as these servers have already been updated to remediate the issue. This vulnerability follows previous critical ScreenConnect flaws from February 2024 (CVE-2024-1709 and CVE-2024-1708) that threat actors, including ransomware groups, actively exploited. According to Microsoft Threat Intelligence, attackers have been deploying malware using static ASP.NET machine keys found in publicly available repositories and documentation. While this new vulnerability operates differently, it highlights the ongoing security challenges facing remote access software in an increasingly distributed work environment. Cyber Security News is a Dedicated News Platform For Cyber News, Cyber Attack News, Hacking News & Vulnerability Analysis. This vulnerability follows a pattern of ViewState code injection attacks that Microsoft warned about in February 2025. Unlike previous attacks that relied on stolen keys from dark web forums, these publicly disclosed keys pose a higher risk due to their availability in multiple code repositories.
This Cyber News was published on cybersecuritynews.com. Publication date: Sat, 26 Apr 2025 03:50:07 +0000