PT-2025-16172 · Unknown+2 · Jupyter-Remote-Desktop-Proxy+2

Frejanordsiek · Published 2025-04-11 · Updated 2025-04-16 · CVE-2025-32428

Positive Technologies (AI Summary)

CVSS v4.0

9.0

Critical

Base vector

AV:A/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Name of the Vulnerable Software and Affected Versions jupyter-remote-desktop-proxy versions 3.0.0 through 3.0.0

Description The issue allows unauthorized network access to TigerVNC, risking system compromise, when jupyter-remote-desktop-proxy is used with TigerVNC. This vulnerability does not affect users having TurboVNC as the vncserver executable.

Recommendations Update to version 3.0.1 to address this security issue. As a temporary workaround, consider switching to TurboVNC to mitigate the risk of exploitation.

Exploit

Fix

Integer Overflow

Exposure of Resource to Wrong Sphere

Weakness Enumeration

CWE-190

CWE-668

Related Identifiers

BDU:2025-10399

CVE-2025-32428

GHSA-VRQ4-9HC3-CGP7

Affected Products

Tigervnc

Turbovnc

Jupyter-Remote-Desktop-Proxy

References · 20

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/32xxx/CVE-2025-32428.json · Exploit
• https://bdu.fstec.ru/vul/2025-10399 · Security Note
• https://osv.dev/vulnerability/GHSA-vrq4-9hc3-cgp7 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2025-32428 · Security Note
• https://osv.dev/vulnerability/CVE-2025-32428 · Vendor Advisory
• https://github.com/jupyterhub/jupyter-remote-desktop-proxy/security/advisories/GHSA-vrq4-9hc3-cgp7 · Note
• https://github.com/jupyterhub/jupyter-remote-desktop-proxy/commit/7dd54c25a4253badd8ea68895437e5a66a59090d · Note
• https://github.com/jupyterhub/jupyter-remote-desktop-proxy · Note
• https://twitter.com/the_yellow_fall/status/1911599296430186685 · Twitter Post
• https://t.me/cvetracker/21577 · Telegram Post
• https://twitter.com/Dinosn/status/1911607030655168744 · Twitter Post
• https://twitter.com/freedomhack101/status/1911758253400506649 · Twitter Post
• https://twitter.com/adriananglin/status/1911667852794384391 · Twitter Post
• https://t.me/pentestingnews/59504 · Telegram Post
• https://twitter.com/elhackernet/status/1912455010077593608 · Twitter Post