CVE-2025-66270

MediumCVSS 4.7/10Last modified Oct 18, 2026

Description

The KDE Connect protocol 8 before 2025-11-28 does not correlate device IDs across two packets. This affects KDE Connect before 25.12 on desktop, KDE Connect before 0.5.4 on iOS, KDE Connect before 1.34.4 on Android, GSConnect before 68, and Valent before 1.0.0.alpha.49.

Metrics

CVSS 3.1 4.7/10CVSS:3.1/AV:A/AC:H/PR:N/UI:N/S:C/C:L/I:L/A:N

Weakness enumeration

CWE-290

Affected software

No affected versions have been published.

Timeline

Published
Dec 5, 2025
Last modified
Oct 18, 2026
NVD status
Deferred

Related CVEs from 2025

CVE-2025-662718.4Clone for Windows provided by ELECOM CO.,LTD. registers a Windows service with an unquoted file path. A user with the write permission on thCVE-2025-662726.5A path traversal vulnerability has been reported to affect Video Station. If a remote attacker gains a user account, they can then exploit tCVE-2025-662737.2A command injection vulnerability has been reported to affect several QNAP operating system versions. If a remote attacker gains an administCVE-2025-662744.9A NULL pointer dereference vulnerability has been reported to affect several QNAP operating system versions. If a remote attacker gains an aCVE-2025-662756.5A path traversal vulnerability has been reported to affect Video Station. If a remote attacker gains a user account, they can then exploit tCVE-2025-662769.8QuTS hero is not affected. We have already fixed the vulnerability in the following version: QTS 5.2.7.3256 build 20250913 and laterCVE-2025-662779.8A link following vulnerability has been reported to affect several QNAP operating system versions. The remote attackers can then exploit theCVE-2025-662786.5A path traversal vulnerability has been reported to affect File Station 5. If a remote attacker gains a user account, they can then exploit CVE-2025-662797.2A command injection vulnerability has been reported to affect several QNAP operating system versions. If a remote attacker gains an administCVE-2025-662807.2An integer overflow or wraparound vulnerability has been reported to affect several QNAP operating system versions. If a remote attacker gaiCVE-2025-662817.2A NULL pointer dereference vulnerability has been reported to affect several QNAP operating system versions. The remote attackers can then eCVE-2025-662844.8Stored cross-site scripting vulnerabilities exist in GroupSession Free edition prior to ver5.7.1, GroupSession byCloud prior to ver5.7.1, an
CVE-2025-66270: Medium severity, CVSS 4.7 | Vulnix