SecuriTricks - CVE-2025-32898

Description

The KDE Connect verification-code protocol before 2025-04-18 uses only 8 characters and therefore allows brute-force attacks. This affects KDE Connect before 1.33.0 on Android, KDE Connect before 25.04 on desktop, KDE Connect before 0.5 on iOS, Valent before 1.0.0.alpha.47, and GSConnect before 59.

Product(s) Impacted

Product	Versions
kde_connect	<1.33.0
kde_connect	<25.04
kde_connect	<0.5
valent	<1.0.0.alpha.47
gsconnect	<59

Weaknesses

Common security weaknesses mapped to this vulnerability.

CWE-331

Insufficient Entropy

The product uses an algorithm or scheme that produces insufficient entropy, leaving patterns or clusters of values that are more likely to occur than others.

References

https://kde.org/info/security/advisory-20250418-3.txt

https://kdeconnect.kde.org

CVSS Score

4.7 / 10

CVSS Data - 3.1

Attack Vector: ADJACENT_NETWORK
Attack Complexity: HIGH
Privileges Required: NONE
Scope: CHANGED
Confidentiality Impact: LOW
Integrity Impact: LOW
Availability Impact: NONE

CVSS:3.1/AV:A/AC:H/PR:N/UI:N/S:C/C:L/I:L/A:N

View Vector String

Timeline

Published: Dec. 5, 2025, 5:16 a.m.
Last Modified: Dec. 8, 2025, 6:27 p.m.

Status : Awaiting Analysis

CVE has been marked for Analysis. Normally once in this state the CVE will be analyzed by NVD staff within 24 hours.

More info

Source

cve@mitre.org

CVE-2025-32898