{"id":"CVE-2025-66270","aliases":["DEBIAN-CVE-2025-66270","DSA-6063-1","DSA-6066-1","EUVD-2025-201386","GHSA-xcg9-fw4f-9chv","UBUNTU-CVE-2025-66270","USN-7905-1","openSUSE-SU-2025:15800-1"],"status":"published","title":"The KDE Connect protocol 8 before 2025-11-28 does not correlate device IDs across two packets....","description":"The KDE Connect protocol 8 before 2025-11-28 does not correlate device IDs across two packets. This affects KDE Connect before 25.12 on desktop, KDE Connect before 0.5.4 on iOS, KDE Connect before 1.34.4 on Android, GSConnect before 68, and Valent before 1.0.0.alpha.49.","severity":{"version":"3.1","score":4.7,"vector":"CVSS:3.1/AV:A/AC:H/PR:N/UI:N/S:C/C:L/I:L/A:N","level":"medium","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-11","score":0.00215,"percentile":0.11945,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-290"],"published":"2025-11-26T00:00:00Z","modified":"2026-10-28T11:06:17Z","fixes":[{"ecosystem":"Debian:13","package":"gnome-shell-extension-gsconnect","fixed_in":["62-1+deb13u1"],"sources":["osv"]},{"ecosystem":"Debian:14","package":"gnome-shell-extension-gsconnect","fixed_in":["71-1"],"sources":["osv"]},{"ecosystem":"Debian:13","package":"kdeconnect","fixed_in":["25.04.2-1+deb13u1"],"sources":["osv"]},{"ecosystem":"Debian:14","package":"kdeconnect","fixed_in":["25.11.80+git20251121.7090b106-1"],"sources":["osv"]},{"ecosystem":"Ubuntu:25.10","package":"kdeconnect","fixed_in":["25.08.1-0ubuntu2.1"],"sources":["osv"]},{"ecosystem":"openSUSE:Tumbleweed","package":"kdeconnect-kde","fixed_in":["25.11.90-1.1"],"sources":["osv"]}],"affected":[{"source":"osv","ecosystem":"Debian:13","package":"gnome-shell-extension-gsconnect","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"62-1+deb13u1"}]}],"versions":["62-1"]},{"source":"osv","ecosystem":"Debian:14","package":"gnome-shell-extension-gsconnect","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"71-1"}]}],"versions":["62-1","67-1","67-2"]},{"source":"osv","ecosystem":"Debian:13","package":"kdeconnect","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"25.04.2-1+deb13u1"}]}],"versions":["25.04.2-1"]},{"source":"osv","ecosystem":"Debian:14","package":"kdeconnect","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"25.11.80+git20251121.7090b106-1"}]}],"versions":["25.04.2-1","25.08.1-1"]},{"source":"osv","ecosystem":"Debian:13","package":"kdeconnect","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"25.04.2-1+deb13u1"}]}],"versions":["25.04.2-1"]},{"source":"osv","ecosystem":"Debian:13","package":"gnome-shell-extension-gsconnect","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"62-1+deb13u1"}]}],"versions":["62-1"]},{"source":"osv","ecosystem":"Ubuntu:25.10","package":"gnome-shell-extension-gsconnect","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["62-1","62-1ubuntu1","67-1"]},{"source":"osv","ecosystem":"Ubuntu:25.10","package":"kdeconnect","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"25.08.1-0ubuntu2.1"}]}],"versions":["24.12.3-0ubuntu2","25.04.0-0ubuntu1","25.04.0-0ubuntu2","25.04.1-0ubuntu1","25.04.2-0ubuntu2","25.04.2-1ubuntu1","25.04.3-0ubuntu1","25.07.80-0ubuntu1","25.07.90-0ubuntu1","25.08.0-0ubuntu1","25.08.1-0ubuntu1","25.08.1-0ubuntu2"]},{"source":"osv","ecosystem":"Ubuntu:25.10","package":"kdeconnect","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"25.08.1-0ubuntu2.1"}]}],"versions":["24.12.3-0ubuntu2","25.04.0-0ubuntu1","25.04.0-0ubuntu2","25.04.1-0ubuntu1","25.04.2-0ubuntu2","25.04.2-1ubuntu1","25.04.3-0ubuntu1","25.07.80-0ubuntu1","25.07.90-0ubuntu1","25.08.0-0ubuntu1","25.08.1-0ubuntu1","25.08.1-0ubuntu2"]},{"source":"osv","ecosystem":"openSUSE:Tumbleweed","package":"kdeconnect-kde","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"25.11.90-1.1"}]}]}],"products":[{"vendor":"kde","product":"kde connect protocol"}],"references":[{"url":"https://invent.kde.org/network/kdeconnect-kde/-/commit/4e53bcdd5d4c28bd9fefd114b807ce35d7b3373e","tags":["web"]},{"url":"https://invent.kde.org/network/kdeconnect-android/-/commit/675d2d24a1eb95d15d9e5bde2b7e2271d5ada6a9","tags":["web"]},{"url":"https://invent.kde.org/network/kdeconnect-ios/-/commit/6c003c22d04270cabc4b262d399c753d55cf9080","tags":["web"]},{"url":"https://github.com/GSConnect/gnome-shell-extension-gsconnect/commit/a38246deec0af50ae218cdc51db32cdd7eb145e3","tags":["fix"]},{"url":"https://github.com/andyholmes/valent/commit/85f773124a67ed1add79e7465bb088ec667cccce","tags":["fix"]},{"url":"https://kde.org/info/security/advisory-20251128-1.txt","tags":["advisory","report"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2025-66270","tags":["advisory"]},{"url":"https://github.com/advisories/GHSA-xcg9-fw4f-9chv"},{"url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/66xxx/CVE-2025-66270.json","tags":["advisory"]},{"url":"https://security-tracker.debian.org/tracker/CVE-2025-66270","tags":["advisory"]},{"url":"https://ubuntu.com/security/CVE-2025-66270","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2025-66270","tags":["report"]},{"url":"https://ubuntu.com/security/notices/USN-7905-1","tags":["advisory"]},{"url":"","tags":["advisory"]},{"url":"https://www.suse.com/security/cve/CVE-2025-66270","tags":["web"]}],"sources":{"cve":[{"id":"CVE-2025-66270","description":"The KDE Connect protocol 8 before 2025-11-28 does not correlate device IDs across two packets. This affects KDE Connect before 25.12 on desktop, KDE Connect before 0.5.4 on iOS, KDE Connect before 1.34.4 on Android, GSConnect before 68, and Valent before 1.0.0.alpha.49.","status":"published","published":"2025-12-05T00:00:00Z","modified":"2025-12-05T17:26:40.066Z","cvss":[{"version":"3.1","score":4.7,"vector":"CVSS:3.1/AV:A/AC:H/PR:N/UI:N/S:C/C:L/I:L/A:N","level":"medium","assessor":"cna"}],"cwes":["CWE-290"],"updated_at":"2026-11-02T14:32:53.157279Z"}],"euvd":[{"id":"EUVD-2025-201386","description":"The KDE Connect protocol 8 before 2025-11-28 does not correlate device IDs across two packets. This affects KDE Connect before 25.12 on desktop, KDE Connect before 0.5.4 on iOS, KDE Connect before 1.34.4 on Android, GSConnect before 68, and Valent before 1.0.0.alpha.49.","status":"published","published":"2025-12-05T00:00:00Z","modified":"2025-12-05T17:26:40Z","cvss":[{"version":"3.1","score":4.7,"vector":"CVSS:3.1/AV:A/AC:H/PR:N/UI:N/S:C/C:L/I:L/A:N","level":"medium"}],"updated_at":"2026-11-02T19:49:09.437744Z"}],"ghsa":[{"id":"GHSA-xcg9-fw4f-9chv","title":"The KDE Connect protocol 8 before 2025-11-28 does not correlate device IDs across two packets....","description":"The KDE Connect protocol 8 before 2025-11-28 does not correlate device IDs across two packets. This affects KDE Connect before 25.12 on desktop, KDE Connect before 0.5.4 on iOS, KDE Connect before 1.34.4 on Android, GSConnect before 68, and Valent before 1.0.0.alpha.49.","status":"published","published":"2025-12-05T06:31:31Z","modified":"2025-12-05T06:31:38Z","cvss":[{"version":"3.1","score":4.7,"vector":"CVSS:3.1/AV:A/AC:H/PR:N/UI:N/S:C/C:L/I:L/A:N","level":"medium"}],"cwes":["CWE-290"],"updated_at":"2026-11-02T15:05:03.911166Z"}],"nvd":[{"id":"CVE-2025-66270","description":"The KDE Connect protocol 8 before 2025-11-28 does not correlate device IDs across two packets. This affects KDE Connect before 25.12 on desktop, KDE Connect before 0.5.4 on iOS, KDE Connect before 1.34.4 on Android, GSConnect before 68, and Valent before 1.0.0.alpha.49.","status":"published","published":"2025-12-05T06:16:09.253Z","modified":"2026-10-18T15:10:00.097Z","cvss":[{"version":"3.1","score":4.7,"vector":"CVSS:3.1/AV:A/AC:H/PR:N/UI:N/S:C/C:L/I:L/A:N","level":"medium","assessor":"secondary"}],"cwes":["CWE-290"],"updated_at":"2026-11-02T14:11:47.746175Z"}],"osv":[{"id":"CVE-2025-66270","description":"The KDE Connect protocol 8 before 2025-11-28 does not correlate device IDs across two packets. This affects KDE Connect before 25.12 on desktop, KDE Connect before 0.5.4 on iOS, KDE Connect before 1.34.4 on Android, GSConnect before 68, and Valent before 1.0.0.alpha.49.","status":"published","published":"2025-12-05T00:00:00Z","modified":"2026-10-28T11:06:17.052898678Z","cvss":[{"version":"3.1","score":4.7,"vector":"CVSS:3.1/AV:A/AC:H/PR:N/UI:N/S:C/C:L/I:L/A:N","level":"medium"}],"cwes":["CWE-290"],"updated_at":"2026-11-02T15:44:52.202386Z"},{"id":"DEBIAN-CVE-2025-66270","description":"The KDE Connect protocol 8 before 2025-11-28 does not correlate device IDs across two packets. This affects KDE Connect before 25.12 on desktop, KDE Connect before 0.5.4 on iOS, KDE Connect before 1.34.4 on Android, GSConnect before 68, and Valent before 1.0.0.alpha.49.","status":"published","published":"2025-12-05T06:16:09.253Z","modified":"2026-10-23T17:47:32.179794226Z","cvss":[{"version":"3.1","score":4.7,"vector":"CVSS:3.1/AV:A/AC:H/PR:N/UI:N/S:C/C:L/I:L/A:N","level":"medium"}],"updated_at":"2026-11-02T15:45:47.697959Z"},{"id":"UBUNTU-CVE-2025-66270","description":"The KDE Connect protocol 8 before 2025-11-28 does not correlate device IDs across two packets. This affects KDE Connect before 25.12 on desktop, KDE Connect before 0.5.4 on iOS, KDE Connect before 1.34.4 on Android, GSConnect before 68, and Valent before 1.0.0.alpha.49.","status":"published","published":"2025-11-27T00:00:00Z","modified":"2026-02-04T03:04:48.894663Z","cvss":[{"version":"3.1","score":4.7,"vector":"CVSS:3.1/AV:A/AC:H/PR:N/UI:N/S:C/C:L/I:L/A:N","level":"medium"}],"updated_at":"2026-11-02T16:55:52.345622Z"},{"id":"DSA-6063-1","title":"kdeconnect - security update","status":"published","published":"2025-11-26T00:00:00Z","modified":"2025-11-26T23:33:02.32587Z","updated_at":"2026-11-02T15:46:18.296714Z"},{"id":"DSA-6066-1","title":"gnome-shell-extension-gsconnect - security update","status":"published","published":"2025-11-30T00:00:00Z","modified":"2025-11-30T16:18:02.933721Z","updated_at":"2026-11-02T15:46:18.296714Z"},{"id":"openSUSE-SU-2025:15800-1","title":"kdeconnect-kde-25.11.90-1.1 on GA media","description":"These are all security issues fixed in the kdeconnect-kde-25.11.90-1.1 package on the GA media of openSUSE Tumbleweed.","status":"published","published":"2025-12-08T00:00:00Z","modified":"2026-03-23T04:54:11.732093Z","updated_at":"2026-11-02T16:58:38.101535Z"},{"id":"USN-7905-1","title":"kdeconnect vulnerability","description":"It was discovered that KDE Connect incorrectly handled device IDs. An\nattacker could possibly use this issue to bypass authentication and connect\nan unpaired device.","status":"published","published":"2025-12-03T09:46:45Z","modified":"2026-04-27T18:28:29.361488Z","updated_at":"2026-11-02T16:58:21.91885Z"}]}}