- Description
- In versions of ScreenConnect™ prior to 25.8, server-side validation and integrity checks within the extension subsystem could allow the installation and execution of untrusted or arbitrary extensions by authorized or administrative users. Abuse of this behavior could result in the execution of custom code on the server or unauthorized access to application configuration data. This issue affects only the ScreenConnect server component; host and guest clients are not impacted. ScreenConnect 25.8 introduces enhanced server-side configuration handling and integrity checks to ensure only trusted extensions can be installed.
- Source
- 7d616e1a-3288-43b1-a0dd-0a65d3e70a49
- NVD status
- Analyzed
- Products
- screenconnect
CVSS 3.1
- Type
- Secondary
- Base score
- 9.1
- Impact score
- 6
- Exploitability score
- 2.3
- Vector string
- CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H
- Severity
- CRITICAL
- 7d616e1a-3288-43b1-a0dd-0a65d3e70a49
- CWE-494
- Hype score
- Not currently trending
Vulnerabilidad crítica en ScreenConnect expone datos de configuración CVE-2025-14265 ConnectWise ha publicado una actualización de seguridad para ScreenConnect™ para abordar una vulnerabilidad crítica https://t.co/i9beRqpCxH https://t.co/iBu8CuENiE
@elhackernet
16 Dec 2025
2711 Impressions
8 Retweets
25 Likes
7 Bookmarks
0 Replies
0 Quotes
CVE-2025-14265: Download of Code Without Integrity Check in ScreenConnect, 9.1 rating 🔥 A server-side vulnerability could allow an authenticated attacker to execute custom code or access configuration data. Search at https://t.co/hv7QKSqxTR: 👉 Link: https://t.co/gQI8mjmTb
@Netlas_io
16 Dec 2025
1698 Impressions
3 Retweets
25 Likes
4 Bookmarks
1 Reply
0 Quotes
🚨🚨CVE-2025-14265 (CVSS 9.1): Extension Vulnerability in ScreenConnect Server Authenticated admins can install/run arbitrary extensions due to weak server-side validation → server-side code execution or config theft. Server-only impact (clients safe). Search by vul.cve ht
@zoomeye_team
16 Dec 2025
2463 Impressions
9 Retweets
38 Likes
7 Bookmarks
0 Replies
0 Quotes
[CVE-2025-14265: CRITICAL] ScreenConnect™ prior to version 25.8 had security vulnerabilities allowing unauthorized installation of extensions. Update to version 25.8 for enhanced security measures.#cve,CVE-2025-14265,#cybersecurity https://t.co/c58NkvWKGA https://t.co/JzdKKqmvG
@CveFindCom
11 Dec 2025
32 Impressions
0 Retweets
1 Like
0 Bookmarks
0 Replies
0 Quotes
[
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:connectwise:screenconnect:*:*:*:*:*:*:*:*",
"matchCriteriaId": "19C5783B-C6B5-4181-80A0-082DF09B007B",
"versionEndExcluding": "25.8.0.9438",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
]