PT-2025-48260 · Unknown+2 · Kdeconnect+3

Published 2025-01-01 · Updated 2026-02-24 · CVE-2025-66270

Positive Technologies (AI Summary)

CVSS v3.1

4.7

Medium

Base vector

AV:A/AC:H/PR:N/UI:N/S:C/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions KDE Connect versions prior to 25.04.2-1+deb13u1 gnome-shell-extension-gsconnect versions prior to 62-1+deb13u1

Description A missing validation of the device ID during handshakes in KDE Connect and gnome-shell-extension-gsconnect could allow an attacker to impersonate another device. The oldstable distribution (bookworm) is not affected.

Recommendations Upgrade KDE Connect packages to version 25.04.2-1+deb13u1. Upgrade gnome-shell-extension-gsconnect packages to version 62-1+deb13u1.

Fix

Authentication Bypass by Spoofing

Weakness Enumeration

CWE-290

Related Identifiers

CVE-2025-66270

DSA-6063-1

DSA-6066-1

OPENSUSE-SU-2025:15800-1

USN-7905-1

Affected Products

Debian

Kdeconnect

Red Os

Gnome-Shell-Extension-Gsconnect

References · 22

• https://osv.dev/vulnerability/UBUNTU-CVE-2025-66270 · Vendor Advisory
• https://osv.dev/vulnerability/DEBIAN-CVE-2025-66270 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2025-66270 · Security Note
• https://osv.dev/vulnerability/openSUSE-SU-2025:15800-1 · Vendor Advisory
• https://ubuntu.com/security/notices/USN-7905-1 · Vendor Advisory
• https://ubuntu.com/security/CVE-2025-66270 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2025-66270 · Vendor Advisory
• https://osv.dev/vulnerability/USN-7905-1 · Vendor Advisory
• https://security-tracker.debian.org/tracker/CVE-2025-66270 · Vendor Advisory
• https://cve.org/CVERecord?id=CVE-2025-66270 · Security Note
• https://github.com/GSConnect/gnome-shell-extension-gsconnect/commit/a38246deec0af50ae218cdc51db32cdd7eb145e3 · Note
• https://github.com/andyholmes/valent/commit/85f773124a67ed1add79e7465bb088ec667cccce · Note
• https://twitter.com/FOSSForce/status/1995561057977299054 · Twitter Post
• https://t.me/CVEtracker/38904 · Telegram Post
• https://invent.kde.org/network/kdeconnect-kde/-/commit/4e53bcdd5d4c28bd9fefd114b807ce35d7b3373e · Note