CVE-2025-14265
BaseFortify
Publication date: 2025-12-11
Last updated on: 2025-12-11
Assigner: ConnectWise
Description
Description
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| screencast | screenconnect | 25.8 |
Helpful Resources
Exploitability
| CWE ID | Description |
|---|---|
| CWE-494 | The product downloads source code or an executable from a remote location and executes the code without sufficiently verifying the origin and integrity of the code. |
Attack-Flow Graph
AI Powered Q&A
Can you explain this vulnerability to me?
This vulnerability exists in versions of ScreenConnect prior to 25.8, where the server-side validation and integrity checks for the extension subsystem are insufficient. This flaw allows authorized or administrative users to install and execute untrusted or arbitrary extensions on the server. As a result, attackers could run custom code on the server or gain unauthorized access to application configuration data.
How can this vulnerability impact me? :
The vulnerability can lead to the execution of arbitrary code on the ScreenConnect server, potentially allowing attackers to compromise the server environment. It can also result in unauthorized access to sensitive application configuration data, which could lead to further security breaches or data exposure.
What immediate steps should I take to mitigate this vulnerability?
Upgrade the ScreenConnect server component to version 25.8 or later, which includes enhanced server-side configuration handling and integrity checks to ensure only trusted extensions can be installed.
How does this vulnerability affect compliance with common standards and regulations (like GDPR, HIPAA)?:
The vulnerability allows unauthorized access to application configuration data and execution of arbitrary code on the server, which could lead to breaches of confidentiality, integrity, and availability of sensitive data. Such breaches could negatively impact compliance with standards and regulations like GDPR and HIPAA that require protection of sensitive data and secure system integrity. Therefore, failure to patch this vulnerability may result in non-compliance with these regulations. [1]