CVE-2025-27459

HighCVSS 7.5/10Last modified Jun 17, 2026

Description

The VNC application stores its passwords encrypted within the registry but uses DES for encryption. As DES is broken, the original passwords can be recovered.

Metrics

CVSS 3.1 7.5/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Weakness enumeration

CWE-257

Affected software

No affected versions have been published.

Timeline

Published
Jul 3, 2025
Last modified
Jun 17, 2026
NVD status
Analyzed

Related CVEs from 2025

CVE-2025-27469.8An authentication bypass vulnerability in Kentico Xperience allows authentication bypass via the Staging Sync Server password handling of emCVE-2025-274606.8The hard drives of the device are not encrypted using a full volume encryption feature such as BitLocker. This allows an attacker with physiCVE-2025-274616.8During startup, the device automatically logs in the EPC2 Windows user without requesting a password.CVE-2025-274629.4[This CNA information record relates to multiple CVEs; the text explains which aspects/vulnerabilities correspond to which CVE.] The WindoCVE-2025-274639.4[This CNA information record relates to multiple CVEs; the text explains which aspects/vulnerabilities correspond to which CVE.] The WindowsCVE-2025-274649.4[This CNA information record relates to multiple CVEs; the text explains which aspects/vulnerabilities correspond to which CVE.] The WindowsCVE-2025-274654.3Certain instructions need intercepting and emulating by Xen. In some cases Xen emulates the instruction by replaying it, using an executablCVE-2025-274669.8[This CNA information record relates to multiple CVEs; the text explains which aspects/vulnerabilities correspond to which CVE.] There are CVE-2025-274677.8Use after free in Windows Digital Media allows an authorized attacker to elevate privileges locally.CVE-2025-274687.0Improper privilege management in Windows Secure Kernel Mode allows an authorized attacker to elevate privileges locally.CVE-2025-274697.5Uncontrolled resource consumption in Windows LDAP - Lightweight Directory Access Protocol allows an unauthorized attacker to deny service ovCVE-2025-27479.8An authentication bypass vulnerability in Kentico Xperience allows authentication bypass via the Staging Sync Server component password hand