CVE-2025-14823
Certificate Signing Extension Returns Encrypted Values
- State
- Published
- Severity
- 5.3 Medium
- Published
- Dec 18, 2025
- Updated
- Dec 18, 2025
- Reserved
- Dec 17, 2025
Description
In deployments using the ScreenConnect™ Certificate Signing Extension, encrypted configuration values including an Azure Key Vault-related key, could be returned to unauthenticated users through a client-facing endpoint under certain conditions. The values remained encrypted and securely stored at rest; however, an encrypted representation could be exposed in client responses. Updating the Certificate Signing Extension to version 1.0.12 or higher ensures configuration handling occurs exclusively on the server side, preventing encrypted values from being transmitted to or rendered by client-side components.
Scores
| CVSS | Score | Vector | Source |
|---|---|---|---|
| 3.1 | 5.3 Medium | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N | ConnectWise |
Weaknesses
- CWE-201 Insertion of Sensitive Information Into Sent Data
Affected Products
| Product | Versions |
|---|---|
ScreenConnectConnectWise |
|
References
Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.