PT-2025-28899 · Connectwise · Connectwise Psa

Michael Newton · Published 2025-07-09 · Updated 2025-08-20 · CVE-2025-7204

Positive Technologies (AI Summary)

CVSS v2.0

6.8

Medium

Base vector

AV:N/AC:L/Au:S/C:C/I:N/A:N

Name of the Vulnerable Software and Affected Versions: ConnectWise PSA versions prior to 2025.9

Description: A vulnerability exists where authenticated users could gain access to sensitive user information. Specific API requests return an overly verbose user object, which includes encrypted password hashes for other users. An attacker or privileged user could use these exposed hashes to conduct offline brute-force or dictionary attacks, potentially leading to credential compromise and privilege escalation within the system.

Recommendations: Update ConnectWise PSA to version 2025.9 or later.

Fix

LPE

Weakness Enumeration

CWE-201

Related Identifiers

BDU:2026-00085

CVE-2025-7204

Affected Products

Connectwise Psa

References · 7

• https://connectwise.com/company/trust/security-bulletins/connectwise-psa-2025.9-security-fix · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2025-7204 · Security Note
• https://osv.dev/vulnerability/CVE-2025-7204 · Vendor Advisory
• https://bdu.fstec.ru/vul/2026-00085 · Security Note
• https://t.me/cveNotify/132935 · Telegram Post
• https://themissinglink.com.au/security-advisories/cve-2025-7204 · Note
• https://twitter.com/CVEnew/status/1943335925901144453 · Twitter Post