CVE-2025-14265 | THREATINT

Description

In versions of ScreenConnect™ prior to 25.8, server-side validation and integrity checks within the extension subsystem could allow the installation and execution of untrusted or arbitrary extensions by authorized or administrative users. Abuse of this behavior could result in the execution of custom code on the server or unauthorized access to application configuration data. This issue affects only the ScreenConnect server component; host and guest clients are not impacted. ScreenConnect 25.8 introduces enhanced server-side configuration handling and integrity checks to ensure only trusted extensions can be installed.

PUBLISHED Reserved 2025-12-08 | Published 2025-12-11 | Updated 2025-12-12 | Assigner ConnectWise

CRITICAL: 9.1CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H

Problem types

CWE-494 Download of Code Without Integrity Check

Product status

Default status

unaffected

All versions prior to 2025.8

affected

Credits

Paul Whiting (Ultraviolet Cyber) finder

References

www.connectwise.com/...s/screenconnect-2025.8-security-patch

cve.org (CVE-2025-14265)

nvd.nist.gov (CVE-2025-14265)

Download JSON