CVE-2025-66270
MediumCVSS 4.7Exploitation Probability (EPSS)
Low risk9th percentile - higher than 9% of all known CVEs
Summary
The KDE Connect protocol 8 before 2025-11-28 does not correlate device IDs across two packets. This affects KDE Connect before 25.12 on desktop, KDE Connect before 0.5.4 on iOS, KDE Connect before 1.34.4 on Android, GSConnect before 68, and Valent before 1.0.0.alpha.49.
Risk Assessment
The lack of device ID correlation may allow an attacker to impersonate another device or disrupt communication, potentially leading to unauthorized access or breach of data confidentiality between devices.
Recommendation
Update KDE Connect to version 25.12 or later on desktop, 0.5.4 or later on iOS, 1.34.4 or later on Android, GSConnect to version 68 or later, and Valent to version 1.0.0.alpha.49 or later.
Other vulnerabilities in KDE Connect
See all- CVE-2025-32900Medium
In the KDE Connect information-exchange protocol before 2025-04-18, a packet can be crafted to temporarily change the displayed information about a device, because broadcast UDP is used. This affects KDE Connect before 1.33.0 on Android, KDE Connect before 25.04 on desktop, KDE Connect before 0.5 on iOS, Valent before 1.0.0.alpha.47, and GSConnect before 59.
- CVE-2025-32898Medium
The KDE Connect verification-code protocol before 2025-04-18 uses only 8 characters and therefore allows brute-force attacks. This affects KDE Connect before 1.33.0 on Android, KDE Connect before 25.04 on desktop, KDE Connect before 0.5 on iOS, Valent before 1.0.0.alpha.47, and GSConnect before 59.
Original NVD description (English source)
The KDE Connect protocol 8 before 2025-11-28 does not correlate device IDs across two packets. This affects KDE Connect before 25.12 on desktop, KDE Connect before 0.5.4 on iOS, KDE Connect before 1.34.4 on Android, GSConnect before 68, and Valent before 1.0.0.alpha.49.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS