CVE-2025-14823: 
ScreenConnect Server vulnerability analysis and mitigation

CVE-2025-14823 is an information disclosure vulnerability (CWE-201: Insertion of Sensitive Information Into Sent Data) affecting the ScreenConnect™ Certificate Signing Extension by ConnectWise. In deployments using this extension, encrypted configuration values — including Azure Key Vault-related keys — could be returned to unauthenticated users through a client-facing endpoint under certain conditions. All ScreenConnect deployments using the Certificate Signing Extension versions prior to 1.0.12 are affected; cloud-hosted instances on screenconnect.com and hostedrmm.com were patched automatically. The vulnerability was disclosed on December 18, 2025, with a CVSS v3.1 base score of 5.3 (Medium) (ConnectWise Advisory, Red Hat CVE).

The root cause is classified as CWE-201 (Insertion of Sensitive Information Into Sent Data): the Certificate Signing Extension improperly included encrypted configuration values in responses delivered through client-facing endpoints, rather than restricting all configuration handling to the server side. An unauthenticated attacker could trigger this exposure by interacting with the affected client-facing endpoint under certain conditions, receiving an encrypted representation of sensitive configuration data — including Azure Key Vault-related keys — in the response. While the values were encrypted at rest and in transit, their exposure as ciphertext creates a risk of offline decryption attacks. The fix in version 1.0.12 ensures configuration handling occurs exclusively server-side, eliminating the transmission of these values to client components (ConnectWise Advisory).

Successful exploitation allows unauthenticated attackers to obtain encrypted representations of sensitive configuration values, including Azure Key Vault-related keys, from client-facing endpoints. Although the values remain encrypted, exposure of the ciphertext introduces risk of offline decryption attacks that could ultimately compromise Azure credentials and associated cloud infrastructure. The confidentiality impact is rated low given the encryption layer, with no integrity or availability impact identified (ConnectWise Advisory, Red Hat CVE).

There is no public proof-of-concept exploit and no evidence of in-the-wild exploitation at this time. The vulnerability requires no authentication, no user interaction, and has low attack complexity, making it straightforward to attempt if targeted. The EPSS score is approximately 0.022% (0.000220), indicating a very low probability of exploitation in the near term. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog (ConnectWise Advisory, Red Hat CVE).

1. Reconnaissance: Identify ScreenConnect deployments that use the Certificate Signing Extension (on-premises instances, as cloud-hosted instances were patched automatically). Look for publicly accessible ScreenConnect servers.
2. Identify client-facing endpoint: Locate the specific client-facing endpoint exposed by the Certificate Signing Extension that returns configuration data in responses.
3. Send unauthenticated request: Issue an HTTP request to the identified endpoint without any authentication credentials, triggering the condition under which encrypted configuration values are included in the server response.
4. Collect encrypted values: Extract the encrypted configuration values (including Azure Key Vault-related keys) from the response body.
5. Offline decryption attempt: Subject the collected ciphertext to offline cryptanalysis or brute-force decryption attempts to recover plaintext credentials, potentially enabling unauthorized access to Azure Key Vault and associated cloud resources (ConnectWise Advisory).

• Network: Unusual or repeated unauthenticated HTTP requests to client-facing endpoints of the ScreenConnect Certificate Signing Extension from external or unexpected IP addresses.
• Logs: Web server or ScreenConnect access logs showing unauthenticated requests to configuration-related endpoints, particularly from scanning tools or automated clients; responses with abnormally large payloads that may contain encrypted configuration data.
• Azure: Unexpected or unauthorized access attempts to Azure Key Vault resources associated with the ScreenConnect deployment; alerts from Azure Monitor or Defender for Cloud regarding anomalous key vault access patterns.

ConnectWise has released Certificate Signing Extension version 1.0.12 to address this vulnerability. On-premises ScreenConnect partners should immediately update the Certificate Signing Extension to version 1.0.12 or higher. No action is required for cloud-hosted instances on screenconnect.com or hostedrmm.com, as these have been updated automatically. After patching, organizations should review access logs for client-facing endpoints to identify any potential prior exposure of encrypted configuration values, and consider rotating Azure Key Vault keys as a precautionary measure (ConnectWise Advisory).