CVE-2025-27457

HighCVSS 7.5/10Last modified Jun 17, 2026

Description

All communication between the VNC server and client(s) is unencrypted. This allows an attacker to intercept the traffic and obtain sensitive data.

Metrics

CVSS 3.1 7.5/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Weakness enumeration

CWE-319

Affected software

No affected versions have been published.

Timeline

Published
Jul 3, 2025
Last modified
Jun 17, 2026
NVD status
Analyzed

Related CVEs from 2025

CVE-2025-274587.5The VNC authentication mechanism bases on a challenge-response system where both server and client use the same password for encryption. TheCVE-2025-274597.5The VNC application stores its passwords encrypted within the registry but uses DES for encryption. As DES is broken, the original passwordsCVE-2025-27469.8An authentication bypass vulnerability in Kentico Xperience allows authentication bypass via the Staging Sync Server password handling of emCVE-2025-274606.8The hard drives of the device are not encrypted using a full volume encryption feature such as BitLocker. This allows an attacker with physiCVE-2025-274616.8During startup, the device automatically logs in the EPC2 Windows user without requesting a password.CVE-2025-274629.4[This CNA information record relates to multiple CVEs; the text explains which aspects/vulnerabilities correspond to which CVE.] The WindoCVE-2025-274639.4[This CNA information record relates to multiple CVEs; the text explains which aspects/vulnerabilities correspond to which CVE.] The WindowsCVE-2025-274649.4[This CNA information record relates to multiple CVEs; the text explains which aspects/vulnerabilities correspond to which CVE.] The WindowsCVE-2025-274654.3Certain instructions need intercepting and emulating by Xen. In some cases Xen emulates the instruction by replaying it, using an executablCVE-2025-274669.8[This CNA information record relates to multiple CVEs; the text explains which aspects/vulnerabilities correspond to which CVE.] There are CVE-2025-274677.8Use after free in Windows Digital Media allows an authorized attacker to elevate privileges locally.CVE-2025-274687.0Improper privilege management in Windows Secure Kernel Mode allows an authorized attacker to elevate privileges locally.
CVE-2025-27457: High severity, CVSS 7.5 | Vulnix