PT-2025-52259 · Connectwise · Screenconnect

Michael Gilliam · Published 2025-12-18 · Updated 2025-12-19 · CVE-2025-14823

Positive Technologies (AI Summary)

CVSS v3.1

5.3

Medium

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

Name of the Vulnerable Software and Affected Versions ScreenConnect versions prior to 1.0.12

Description In deployments utilizing the Certificate Signing Extension, encrypted configuration values, potentially including an Azure Key Vault-related key, could be disclosed to unauthenticated users via a client-facing endpoint under specific circumstances. While the values were encrypted and securely stored, their encrypted representation was potentially exposed in client responses. The issue relates to configuration handling occurring on the client side, allowing encrypted values to be transmitted to and rendered by client components.

Recommendations Update the Certificate Signing Extension to version 1.0.12 or higher to ensure configuration handling occurs exclusively on the server side, preventing encrypted values from being transmitted to or rendered by client-side components.

Fix

Weakness Enumeration

CWE-201

Related Identifiers

CVE-2025-14823

Affected Products

Screenconnect

References · 5

• https://connectwise.com/company/trust/security-bulletins/2025-12-18-screenconnect-certificate-signing-extension-update · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2025-14823 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2025-14823 · Security Note
• https://twitter.com/CVEnew/status/2001728024392405263 · Twitter Post
• https://twitter.com/VulmonFeeds/status/2001846509113860101 · Twitter Post