TI-2025-13525 Aliases CVE-2025-14823 GHSA-pxwx-c9g9-pm9p

Certificate Signing Extension Returns Encrypted Values

LOW 29CWE-201Published 2025-12-18 · Updated 2025-12-18

Key facts

Attack vector: Network
Privileges required: None
User interaction: None
Attack complexity: Low
Impact type: Information disclosure
Confidentiality · integrity · availability: Low · None · None
Fix status: No fix listed

Attack profile from CVSS 3.1 · CNA. Fix status from CNA. Impact type from CWE-201.

Summary

In deployments using the ScreenConnect™ Certificate Signing Extension, encrypted configuration values including an Azure Key Vault-related key, could be returned to unauthenticated users through a client-facing endpoint under certain conditions. The values remained encrypted and securely stored at rest; however, an encrypted representation could be exposed in client responses. Updating the Certificate Signing Extension to version 1.0.12 or higher ensures configuration handling occurs exclusively on the server side, preventing encrypted values from being transmitted to or rendered by client-side components.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV

EPSS 0.00152 4th percentileScored 2026-11-07

Fix No fix listed No fixed version in the sources yet

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation: None
Automatable: Yes
Technical impact: Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

Vendor	Product	Affected versions	Fixed in	Status	Source
ConnectWise	ScreenConnect	ScreenConnect (all supported versions) when used with the Certificate Signing Extension versions prior to 1.0.12	—	No fix listed	CNA

ScreenConnect VendorConnectWise Affected ScreenConnect (all supported versions) when used with the Certificate Signing Extension versions prior to 1.0.12 Fixed in — No fix listed CNA

CPE configurations NVD · 1

CPE	Versions	Role	Vendor
cpe:2.3:a:connectwise:screenconnect::::::::	before 1.0.12	Vulnerable	ConnectWise

cpe:2.3:a:connectwise:screenconnect:*:*:*:*:*:*:*:* Versions before 1.0.12 Vulnerable ·ConnectWise

Remediation

No fixed version listed by the sources yet.

Timeline

2026-10-02 Threatist record created from CVE-2025-14823
2026-10-03 Alias added: GHSA-pxwx-c9g9-pm9p

References

Advisory 1

https://www.connectwise.com/company/trust/security-bulletins/2025-12-18-screenconnect-certificate-signing-extension-update

TI-2026-58346 ScreenConnect Client: Guest-to-Host File Execution via File-Transfer Actions KEVCVSS 3.1CRITICAL 9.9
TI-2024-01589 Authentication bypass using an alternate path or channel KEVCVSS 3.1CRITICAL 10.0
TI-2024-01588 Improper limitation of a pathname to a restricted directory (“path traversal”) KEVCVSS 3.1HIGH 8.4
TI-2025-03479 ScreenConnect Exposure to ASP.NET ViewState Code Injection KEVCVSS 3.1HIGH 8.1
TI-2025-13036 Improper server-side validation in ScreenConnect extension framework CVSS 3.1CRITICAL 9.1
TI-2023-25574 ConnectWise ScreenConnect through 23.8.4 allows man-in-the-middle attackers to achieve… CVSS 3.1HIGH 8.1

See all 9 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences