CVE-2025-14265

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2025-14265", "assignerOrgId": "7d616e1a-3288-43b1-a0dd-0a65d3e70a49", "state": "PUBLISHED", "assignerShortName": "ConnectWise", "dateReserved": "2025-12-08T12:25:20.291Z", "datePublished": "2025-12-11T14:21:53.234Z", "dateUpdated": "2026-11-03T22:02:51.508Z"}, "containers": {"cna": {"affected": [{"defaultStatus": "unaffected", "modules": ["Web Application Server"], "product": "ScreenConnect", "vendor": "ConnectWise", "versions": [{"status": "affected", "version": "All versions prior to 2025.8"}]}], "credits": [{"lang": "en", "type": "finder", "value": "Paul Whiting (Ultraviolet Cyber)"}], "descriptions": [{"lang": "en", "supportingMedia": [{"base64": false, "type": "text/html", "value": "In versions of ScreenConnect\u2122 prior to 25.8, server-side validation and integrity checks within the extension subsystem could allow the installation and execution of untrusted or arbitrary extensions by authorized or administrative users. Abuse of this behavior could result in the execution of custom code on the server or unauthorized access to application configuration data. This issue affects only the ScreenConnect server component; host and guest clients are not impacted. ScreenConnect 25.8 introduces enhanced server-side configuration handling and integrity checks to ensure only trusted extensions can be installed.<br>"}], "value": "In versions of ScreenConnect\u2122 prior to 25.8, server-side validation and integrity checks within the extension subsystem could allow the installation and execution of untrusted or arbitrary extensions by authorized or administrative users. Abuse of this behavior could result in the execution of custom code on the server or unauthorized access to application configuration data. This issue affects only the ScreenConnect server component; host and guest clients are not impacted. ScreenConnect 25.8 introduces enhanced server-side configuration handling and integrity checks to ensure only trusted extensions can be installed."}], "impacts": [{"capecId": "CAPEC-137", "descriptions": [{"lang": "en", "value": "CAPEC-137 Parameter Injection"}]}], "metrics": [{"cvssV3_1": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 9.1, "baseSeverity": "CRITICAL", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "HIGH", "scope": "CHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H", "version": "3.1"}, "format": "CVSS", "scenarios": [{"lang": "en", "value": "GENERAL"}]}], "problemTypes": [{"descriptions": [{"cweId": "CWE-494", "description": "CWE-494 Download of Code Without Integrity Check", "lang": "en", "type": "CWE"}]}], "providerMetadata": {"orgId": "7d616e1a-3288-43b1-a0dd-0a65d3e70a49", "shortName": "ConnectWise", "dateUpdated": "2025-12-11T21:19:13.087Z"}, "references": [{"url": "https://www.connectwise.com/company/trust/security-bulletins/screenconnect-2025.8-security-patch"}], "solutions": [{"lang": "en", "supportingMedia": [{"base64": false, "type": "text/html", "value": "<br><p><b>Cloud:&nbsp;</b>No action is required. ScreenConnect servers hosted in\n\u201cscreenconnect.com\u201d cloud (standalone and Automate/RMM integrated) or\n\u201chostedrmm.com\u201d for Automate partners have been updated to remediate the\nissue.\u202f&nbsp;&nbsp;</p>\n\n\n\n\n\n<p><b>On-prem:</b></p>\n\n<p></p><ul><li><a target=\"_blank\" rel=\"nofollow\"><b>ScreenConnect</b> <b>Partners:&nbsp;</b></a>Please upgrade to ScreenConnect version 25.8 and update\nyour guest clients to the same version. Visit <a target=\"_blank\" rel=\"nofollow\" href=\"https://order.screenconnect.com/Create-Order\">Download\n| ScreenConnect</a> page to download and apply the update <i>(access\nrequires a valid on-premises license)</i>.&nbsp;</li><li><a target=\"_blank\" rel=\"nofollow\"><b>Automate On-Prem Partners with\nScreenConnect Integration</b>:&nbsp;</a>\n\nPartners using an on-premises ScreenConnect installation integrated with Automate must ensure that the Automate ScreenConnect Extension is updated to version 4.4.0.16 before upgrading the ScreenConnect server to version 25.8. Once confirmed, visit the \n\n<a target=\"_blank\" rel=\"nofollow\" href=\"https://docs.connectwise.com/ConnectWise_Automate_Documentation/Automate_Product_Updates\">Automate Product Updates</a> \n\n page to download and apply the ScreenConnect 25.8 update.<br></li></ul><a target=\"_blank\" rel=\"nofollow\"></a><p></p>\n\n\n\n\n\n\n\n\n\n<div>\n\n\n\n\n\n<div>\n\n\n\n<p><br></p></div></div>"}], "value": "Cloud:\u00a0No action is required. ScreenConnect servers hosted in\n\u201cscreenconnect.com\u201d cloud (standalone and Automate/RMM integrated) or\n\u201chostedrmm.com\u201d for Automate partners have been updated to remediate the\nissue.\u202f\u00a0\u00a0\n\n\n\n\n\n\n\nOn-prem:\n\n\n\n\n\n * ScreenConnect Partners:\u00a0Please upgrade to ScreenConnect version 25.8 and update\nyour guest clients to the same version. Visit Download\n| ScreenConnect page to download and apply the update (access\nrequires a valid on-premises license).\u00a0\n * Automate On-Prem Partners with\nScreenConnect Integration:\u00a0\n\nPartners using an on-premises ScreenConnect installation integrated with Automate must ensure that the Automate ScreenConnect Extension is updated to version 4.4.0.16 before upgrading the ScreenConnect server to version 25.8. Once confirmed, visit the \n\n Automate Product Updates https://docs.connectwise.com/ConnectWise_Automate_Documentation/Automate_Product_Updates \n\n page to download and apply the ScreenConnect 25.8 update."}], "source": {"discovery": "UNKNOWN"}, "title": "Improper server-side validation in ScreenConnect extension framework", "x_generator": {"engine": "Vulnogram 0.5.0"}}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2025-14265", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "total"}], "version": "2.0.3", "timestamp": "2025-12-12T04:55:51.377077Z"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-11-03T22:02:51.508Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2025-14265", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "total"}], "version": "2.0.3", "timestamp": "2025-12-12T04:55:51.377077Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2025-12-11T14:43:51.951Z"}}], "cna": {"title": "Improper server-side validation in ScreenConnect extension framework", "source": {"discovery": "UNKNOWN"}, "credits": [{"lang": "en", "type": "finder", "value": "Paul Whiting (Ultraviolet Cyber)"}], "impacts": [{"capecId": "CAPEC-137", "descriptions": [{"lang": "en", "value": "CAPEC-137 Parameter Injection"}]}], "metrics": [{"format": "CVSS", "cvssV3_1": {"scope": "CHANGED", "version": "3.1", "baseScore": 9.1, "attackVector": "NETWORK", "baseSeverity": "CRITICAL", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "HIGH", "confidentialityImpact": "HIGH"}, "scenarios": [{"lang": "en", "value": "GENERAL"}]}], "affected": [{"vendor": "ConnectWise", "modules": ["Web Application Server"], "product": "ScreenConnect", "versions": [{"status": "affected", "version": "All versions prior to 2025.8"}], "defaultStatus": "unaffected"}], "solutions": [{"lang": "en", "value": "Cloud:\u00a0No action is required. ScreenConnect servers hosted in\n\u201cscreenconnect.com\u201d cloud (standalone and Automate/RMM integrated) or\n\u201chostedrmm.com\u201d for Automate partners have been updated to remediate the\nissue.\u202f\u00a0\u00a0\n\n\n\n\n\n\n\nOn-prem:\n\n\n\n\n\n * ScreenConnect Partners:\u00a0Please upgrade to ScreenConnect version 25.8 and update\nyour guest clients to the same version. Visit Download\n| ScreenConnect page to download and apply the update (access\nrequires a valid on-premises license).\u00a0\n * Automate On-Prem Partners with\nScreenConnect Integration:\u00a0\n\nPartners using an on-premises ScreenConnect installation integrated with Automate must ensure that the Automate ScreenConnect Extension is updated to version 4.4.0.16 before upgrading the ScreenConnect server to version 25.8. Once confirmed, visit the \n\n Automate Product Updates https://docs.connectwise.com/ConnectWise_Automate_Documentation/Automate_Product_Updates \n\n page to download and apply the ScreenConnect 25.8 update.", "supportingMedia": [{"type": "text/html", "value": "<br><p><b>Cloud:&nbsp;</b>No action is required. ScreenConnect servers hosted in\n\u201cscreenconnect.com\u201d cloud (standalone and Automate/RMM integrated) or\n\u201chostedrmm.com\u201d for Automate partners have been updated to remediate the\nissue.\u202f&nbsp;&nbsp;</p>\n\n\n\n\n\n<p><b>On-prem:</b></p>\n\n<p></p><ul><li><a target=\"_blank\" rel=\"nofollow\"><b>ScreenConnect</b> <b>Partners:&nbsp;</b></a>Please upgrade to ScreenConnect version 25.8 and update\nyour guest clients to the same version. Visit <a target=\"_blank\" rel=\"nofollow\" href=\"https://order.screenconnect.com/Create-Order\">Download\n| ScreenConnect</a> page to download and apply the update <i>(access\nrequires a valid on-premises license)</i>.&nbsp;</li><li><a target=\"_blank\" rel=\"nofollow\"><b>Automate On-Prem Partners with\nScreenConnect Integration</b>:&nbsp;</a>\n\nPartners using an on-premises ScreenConnect installation integrated with Automate must ensure that the Automate ScreenConnect Extension is updated to version 4.4.0.16 before upgrading the ScreenConnect server to version 25.8. Once confirmed, visit the \n\n<a target=\"_blank\" rel=\"nofollow\" href=\"https://docs.connectwise.com/ConnectWise_Automate_Documentation/Automate_Product_Updates\">Automate Product Updates</a> \n\n page to download and apply the ScreenConnect 25.8 update.<br></li></ul><a target=\"_blank\" rel=\"nofollow\"></a><p></p>\n\n\n\n\n\n\n\n\n\n<div>\n\n\n\n\n\n<div>\n\n\n\n<p><br></p></div></div>", "base64": false}]}], "references": [{"url": "https://www.connectwise.com/company/trust/security-bulletins/screenconnect-2025.8-security-patch"}], "x_generator": {"engine": "Vulnogram 0.5.0"}, "descriptions": [{"lang": "en", "value": "In versions of ScreenConnect\u2122 prior to 25.8, server-side validation and integrity checks within the extension subsystem could allow the installation and execution of untrusted or arbitrary extensions by authorized or administrative users. Abuse of this behavior could result in the execution of custom code on the server or unauthorized access to application configuration data. This issue affects only the ScreenConnect server component; host and guest clients are not impacted. ScreenConnect 25.8 introduces enhanced server-side configuration handling and integrity checks to ensure only trusted extensions can be installed.", "supportingMedia": [{"type": "text/html", "value": "In versions of ScreenConnect\u2122 prior to 25.8, server-side validation and integrity checks within the extension subsystem could allow the installation and execution of untrusted or arbitrary extensions by authorized or administrative users. Abuse of this behavior could result in the execution of custom code on the server or unauthorized access to application configuration data. This issue affects only the ScreenConnect server component; host and guest clients are not impacted. ScreenConnect 25.8 introduces enhanced server-side configuration handling and integrity checks to ensure only trusted extensions can be installed.<br>", "base64": false}]}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-494", "description": "CWE-494 Download of Code Without Integrity Check"}]}], "providerMetadata": {"orgId": "7d616e1a-3288-43b1-a0dd-0a65d3e70a49", "shortName": "ConnectWise", "dateUpdated": "2025-12-11T21:19:13.087Z"}}}, "cveMetadata": {"cveId": "CVE-2025-14265", "state": "PUBLISHED", "dateUpdated": "2026-11-03T22:02:51.508Z", "dateReserved": "2025-12-08T12:25:20.291Z", "assignerOrgId": "7d616e1a-3288-43b1-a0dd-0a65d3e70a49", "datePublished": "2025-12-11T14:21:53.234Z", "assignerShortName": "ConnectWise"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"defaultStatus": "unaffected", "modules": ["Web Application Server"], "product": "ScreenConnect", "vendor": "ConnectWise", "versions": [{"status": "affected", "version": "All versions prior to 2025.8"}]}], "source": "7d616e1a-3288-43b1-a0dd-0a65d3e70a49"}], "configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:connectwise:screenconnect:*:*:*:*:*:*:*:*", "matchCriteriaId": "19C5783B-C6B5-4181-80A0-082DF09B007B", "versionEndExcluding": "25.8.0.9438", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "cveTags": [], "descriptions": [{"lang": "en", "value": "In versions of ScreenConnect\u2122 prior to 25.8, server-side validation and integrity checks within the extension subsystem could allow the installation and execution of untrusted or arbitrary extensions by authorized or administrative users. Abuse of this behavior could result in the execution of custom code on the server or unauthorized access to application configuration data. This issue affects only the ScreenConnect server component; host and guest clients are not impacted. ScreenConnect 25.8 introduces enhanced server-side configuration handling and integrity checks to ensure only trusted extensions can be installed."}, {"lang": "es", "value": "En versiones de ScreenConnect\u2122 anteriores a la 25.8, la validaci\u00f3n del lado del servidor y las comprobaciones de integridad dentro del subsistema de extensiones podr\u00edan permitir la instalaci\u00f3n y ejecuci\u00f3n de extensiones no confiables o arbitrarias por parte de usuarios autorizados o administrativos. El abuso de este comportamiento podr\u00eda resultar en la ejecuci\u00f3n de c\u00f3digo personalizado en el servidor o acceso no autorizado a datos de configuraci\u00f3n de la aplicaci\u00f3n. Este problema afecta solo al componente de servidor de ScreenConnect; los clientes anfitri\u00f3n y invitado no se ven afectados. ScreenConnect 25.8 introduce un manejo mejorado de la configuraci\u00f3n del lado del servidor y comprobaciones de integridad para asegurar que solo se puedan instalar extensiones confiables."}], "id": "CVE-2025-14265", "lastModified": "2026-10-07T20:10:01.970", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 9.1, "baseSeverity": "CRITICAL", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "HIGH", "scope": "CHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H", "version": "3.1"}, "exploitabilityScore": 2.3, "impactScore": 6.0, "source": "7d616e1a-3288-43b1-a0dd-0a65d3e70a49", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2025-14265", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "total"}], "role": "CISA Coordinator", "timestamp": "2025-12-12T04:55:51.377077Z", "version": "2.0.3"}}]}, "published": "2025-12-11T15:15:46.863", "references": [{"source": "7d616e1a-3288-43b1-a0dd-0a65d3e70a49", "tags": ["Vendor Advisory"], "url": "https://www.connectwise.com/company/trust/security-bulletins/screenconnect-2025.8-security-patch"}], "sourceIdentifier": "7d616e1a-3288-43b1-a0dd-0a65d3e70a49", "vulnStatus": "Analyzed", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-494"}], "source": "7d616e1a-3288-43b1-a0dd-0a65d3e70a49", "type": "Secondary"}]}

{}

{"created": "2025-12-11T21:37:38.735923+00:00", "updated": "2025-12-11T21:37:38.735969+00:00", "vendors": ["connectwise", "connectwise$PRODUCT$screenconnect"]}