High · published April 25, 2025
CVSS calls it high at 8.1. It is confirmed in active exploitation. It sits in the 89.2th percentile for exploit probability.
⚡ A ViewState code injection could let attackers play puppet master with your server! 😱 Think of ViewState like a restaurant's order ticket that keeps track of everything a customer wants. If a chef receives a forged ticket with unexpected items, they might whip up something dangerous instead of the customer’s meal — that’s the risk here! If attackers gain access to the machine keys and inject a malicious ViewState, they could execute arbitrary code on the server. This means they could potentially steal sensitive information, change settings, or even take complete control of the system! The implications are absolutely devastating.
Think of ViewState like a restaurant's order ticket that keeps track of everything a customer wants. If a chef receives a forged ticket with unexpected items, they might whip up something dangerous instead of the customer’s meal — that’s the risk here! ScreenConnect versions 25.2.3 and earlier are vulnerable to a ViewState code injection attack due to the way ASP.NET Web Forms encode state data. If an attacker compromises machine keys, they can craft a malicious ViewState to execute code remotely.
If attackers gain access to the machine keys and inject a malicious ViewState, they could execute arbitrary code on the server. This means they could potentially steal sensitive information, change settings, or even take complete control of the system! The implications are absolutely devastating. Update your ScreenConnect to version 2025.4 immediately to disable ViewState and remove this vulnerability. Ensure your system's security by reviewing and tightening access controls to prevent unauthorized access to machine keys. Regularly audit your security practices to stay ahead! You've got this! Follow these steps, and you'll keep your system safe and sound! 🛡️