cve/2025/CVE-2025-7204.md

CVE-2025-7204

Description

In ConnectWise PSA versions older than 2025.9, avulnerability exists where authenticated users could gain access to sensitiveuser information. Specific API requests were found to return an overly verboseuser object, which included encrypted password hashes for other users.Authenticated users could then retrieve these hashes. Anattacker or privileged user could then use these exposed hashes to conductoffline brute-force or dictionary attacks. Such attacks could lead tocredential compromise, allowing unauthorized access to accounts, andpotentially privilege escalation within the system.

POC

Reference

No PoCs from references.

Github

• https://github.com/fkie-cad/nvd-json-data-feeds