CVE-2025-32898

The KDE Connect verification-code protocol before 2025-04-18 uses only 8 characters and therefore allows brute-force attacks. This affects KDE Connect before 1.33.0 on Android, KDE Connect before 25.04 on desktop, KDE Connect before 0.5 on iOS, Valent before 1.0.0.alpha.47, and GSConnect before 59.

CVSS v3 4.7 MEDIUM

4.7^/10

CVSS v3 : MEDIUM

Vector :

Exploitability : 1.6 / Impact : 2.7

Attack Vector ADJACENT_NETWORK

Attack Complexity HIGH

Privileges Required NONE

User Interaction NONE

Confidentiality Impact LOW

Integrity Impact LOW

Availability Impact NONE

Scope CHANGED

References

Link	Resource
https://kde.org/info/security/advisory-20250418-3.txt
https://kdeconnect.kde.org

Configurations

No configuration.

History

25 Sep 2026, 23:10

Type	Values Removed	Values Added
Summary		(es) El protocolo de código de verificación de KDE Connect anterior al 18-04-2025 utiliza solo 8 caracteres y, por lo tanto, permite ataques de fuerza bruta. Esto afecta a KDE Connect anterior a la versión 1.33.0 en Android, KDE Connect anterior a la versión 25.04 en escritorio, KDE Connect anterior a la versión 0.5 en iOS, Valent anterior a la versión 1.0.0.alpha.47, y GSConnect anterior a la versión 59.

Information

Published : 2025-12-05 05:16

Updated : 2026-09-25 23:10

NVD link : CVE-2025-32898

Mitre link : CVE-2025-32898

CVE.ORG link : CVE-2025-32898

JSON object : View

Products Affected

No product.

CWE

CWE-331

Insufficient Entropy

{"id": "CVE-2025-32898", "cveTags": [], "metrics": {"ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2025-32898", "role": "CISA Coordinator", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "version": "2.0.3", "timestamp": "2025-12-05T14:40:10.477197Z"}}], "cvssMetricV31": [{"type": "Secondary", "source": "cve@mitre.org", "cvssData": {"scope": "CHANGED", "version": "3.1", "baseScore": 4.7, "attackVector": "ADJACENT_NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:A/AC:H/PR:N/UI:N/S:C/C:L/I:L/A:N", "integrityImpact": "LOW", "userInteraction": "NONE", "attackComplexity": "HIGH", "availabilityImpact": "NONE", "privilegesRequired": "NONE", "confidentialityImpact": "LOW"}, "impactScore": 2.7, "exploitabilityScore": 1.6}]}, "affected": [{"source": "cve@mitre.org", "affectedData": [{"vendor": "KDE", "product": "KDE Connect verification-code protocol", "versions": [{"status": "affected", "version": "0", "lessThan": "2025-04-18", "versionType": "custom"}], "defaultStatus": "unaffected"}]}], "published": "2025-12-05T05:16:58.480", "references": [{"url": "https://kde.org/info/security/advisory-20250418-3.txt", "source": "cve@mitre.org"}, {"url": "https://kdeconnect.kde.org", "source": "cve@mitre.org"}], "vulnStatus": "Deferred", "weaknesses": [{"type": "Secondary", "source": "cve@mitre.org", "description": [{"lang": "en", "value": "CWE-331"}]}], "descriptions": [{"lang": "en", "value": "The KDE Connect verification-code protocol before 2025-04-18 uses only 8 characters and therefore allows brute-force attacks. This affects KDE Connect before 1.33.0 on Android, KDE Connect before 25.04 on desktop, KDE Connect before 0.5 on iOS, Valent before 1.0.0.alpha.47, and GSConnect before 59."}, {"lang": "es", "value": "El protocolo de c\u00f3digo de verificaci\u00f3n de KDE Connect anterior al 18-04-2025 utiliza solo 8 caracteres y, por lo tanto, permite ataques de fuerza bruta. Esto afecta a KDE Connect anterior a la versi\u00f3n 1.33.0 en Android, KDE Connect anterior a la versi\u00f3n 25.04 en escritorio, KDE Connect anterior a la versi\u00f3n 0.5 en iOS, Valent anterior a la versi\u00f3n 1.0.0.alpha.47, y GSConnect anterior a la versi\u00f3n 59."}], "lastModified": "2026-09-25T23:10:00.463", "sourceIdentifier": "cve@mitre.org"}