{"schemaVersion":3,"id":"CVE-2025-66270","aliases":["UBUNTU-CVE-2025-66270","USN-7905-1","DEBIAN-CVE-2025-66270","DSA-6063-1","DSA-6066-1","openSUSE-SU-2025:15800-1"],"status":"published","duplicateOf":null,"title":null,"description":"The KDE Connect protocol 8 before 2025-11-28 does not correlate device IDs across two packets. This affects KDE Connect before 25.12 on desktop, KDE Connect before 0.5.4 on iOS, KDE Connect before 1.34.4 on Android, GSConnect before 68, and Valent before 1.0.0.alpha.49.","dates":{"published":"2025-12-05T00:00:00.000Z","modified":"2025-12-05T17:26:40.066Z","reserved":null,"kevAdded":[],"kevDue":[]},"cvss":{"headline":{"score":4.7,"severity":"medium","version":"3.1","versionLabel":"v3.1","source":"CVE.org","vector":"CVSS:3.1/AV:A/AC:H/PR:N/UI:N/S:C/C:L/I:L/A:N","computed":false,"selection":"backend-summary"},"metrics":[{"version":"3.1","versionLabel":"v3.1","source":"CVE.org","score":4.7,"severity":"medium","vector":"CVSS:3.1/AV:A/AC:H/PR:N/UI:N/S:C/C:L/I:L/A:N","exploitability":null,"impact":null,"computed":false},{"version":"3.1","versionLabel":"v3.1","source":"OSV · Ubuntu","score":4.7,"severity":"medium","vector":"CVSS:3.1/AV:A/AC:H/PR:N/UI:N/S:C/C:L/I:L/A:N","exploitability":4.1,"impact":4.5,"computed":true},{"version":"3.1","versionLabel":"v3.1","source":"OSV · Debian","score":4.7,"severity":"medium","vector":"CVSS:3.1/AV:A/AC:H/PR:N/UI:N/S:C/C:L/I:L/A:N","exploitability":4.1,"impact":4.5,"computed":true},{"version":"3.1","versionLabel":"v3.1","source":"NVD","score":4.7,"severity":"medium","vector":"CVSS:3.1/AV:A/AC:H/PR:N/UI:N/S:C/C:L/I:L/A:N","exploitability":null,"impact":null,"computed":false}]},"epss":{"probability":0.002,"percentile":0.09334,"severity":"low","asOf":"2026-10-20T00:00:00.000Z","change":{"pp":0,"baselineDate":"2026-09-20T00:00:00.000Z","baselineScore":0.002},"history":[{"date":"2026-09-14T00:00:00.000Z","score":0.002,"percentile":null},{"date":"2026-09-15T00:00:00.000Z","score":0.002,"percentile":null},{"date":"2026-09-16T00:00:00.000Z","score":0.002,"percentile":null},{"date":"2026-09-17T00:00:00.000Z","score":0.002,"percentile":null},{"date":"2026-09-18T00:00:00.000Z","score":0.002,"percentile":null},{"date":"2026-09-19T00:00:00.000Z","score":0.002,"percentile":null},{"date":"2026-09-20T00:00:00.000Z","score":0.002,"percentile":null},{"date":"2026-09-21T00:00:00.000Z","score":0.002,"percentile":null},{"date":"2026-09-22T00:00:00.000Z","score":0.002,"percentile":null},{"date":"2026-09-23T00:00:00.000Z","score":0.002,"percentile":null},{"date":"2026-09-24T00:00:00.000Z","score":0.002,"percentile":null},{"date":"2026-09-25T00:00:00.000Z","score":0.002,"percentile":null},{"date":"2026-09-26T00:00:00.000Z","score":0.002,"percentile":null},{"date":"2026-09-27T00:00:00.000Z","score":0.002,"percentile":null},{"date":"2026-09-28T00:00:00.000Z","score":0.002,"percentile":null},{"date":"2026-09-29T00:00:00.000Z","score":0.002,"percentile":null},{"date":"2026-09-30T00:00:00.000Z","score":0.002,"percentile":null},{"date":"2026-10-01T00:00:00.000Z","score":0.002,"percentile":null},{"date":"2026-10-02T00:00:00.000Z","score":0.002,"percentile":null},{"date":"2026-10-03T00:00:00.000Z","score":0.002,"percentile":null},{"date":"2026-10-04T00:00:00.000Z","score":0.002,"percentile":null},{"date":"2026-10-05T00:00:00.000Z","score":0.002,"percentile":null},{"date":"2026-10-06T00:00:00.000Z","score":0.002,"percentile":null},{"date":"2026-10-07T00:00:00.000Z","score":0.002,"percentile":null},{"date":"2026-10-08T00:00:00.000Z","score":0.002,"percentile":null},{"date":"2026-10-09T00:00:00.000Z","score":0.002,"percentile":null},{"date":"2026-10-10T00:00:00.000Z","score":0.002,"percentile":null},{"date":"2026-10-11T00:00:00.000Z","score":0.002,"percentile":null},{"date":"2026-10-12T00:00:00.000Z","score":0.002,"percentile":null},{"date":"2026-10-13T00:00:00.000Z","score":0.002,"percentile":null},{"date":"2026-10-14T00:00:00.000Z","score":0.002,"percentile":null},{"date":"2026-10-15T00:00:00.000Z","score":0.002,"percentile":null},{"date":"2026-10-16T00:00:00.000Z","score":0.002,"percentile":null},{"date":"2026-10-17T00:00:00.000Z","score":0.002,"percentile":null},{"date":"2026-10-18T00:00:00.000Z","score":0.002,"percentile":null},{"date":"2026-10-19T00:00:00.000Z","score":0.002,"percentile":null},{"date":"2026-10-20T00:00:00.000Z","score":0.002,"percentile":0.09334}],"last30":[{"date":"2026-09-20T00:00:00.000Z","score":0.002,"percentile":null},{"date":"2026-09-21T00:00:00.000Z","score":0.002,"percentile":null},{"date":"2026-09-22T00:00:00.000Z","score":0.002,"percentile":null},{"date":"2026-09-23T00:00:00.000Z","score":0.002,"percentile":null},{"date":"2026-09-24T00:00:00.000Z","score":0.002,"percentile":null},{"date":"2026-09-25T00:00:00.000Z","score":0.002,"percentile":null},{"date":"2026-09-26T00:00:00.000Z","score":0.002,"percentile":null},{"date":"2026-09-27T00:00:00.000Z","score":0.002,"percentile":null},{"date":"2026-09-28T00:00:00.000Z","score":0.002,"percentile":null},{"date":"2026-09-29T00:00:00.000Z","score":0.002,"percentile":null},{"date":"2026-09-30T00:00:00.000Z","score":0.002,"percentile":null},{"date":"2026-10-01T00:00:00.000Z","score":0.002,"percentile":null},{"date":"2026-10-02T00:00:00.000Z","score":0.002,"percentile":null},{"date":"2026-10-03T00:00:00.000Z","score":0.002,"percentile":null},{"date":"2026-10-04T00:00:00.000Z","score":0.002,"percentile":null},{"date":"2026-10-05T00:00:00.000Z","score":0.002,"percentile":null},{"date":"2026-10-06T00:00:00.000Z","score":0.002,"percentile":null},{"date":"2026-10-07T00:00:00.000Z","score":0.002,"percentile":null},{"date":"2026-10-08T00:00:00.000Z","score":0.002,"percentile":null},{"date":"2026-10-09T00:00:00.000Z","score":0.002,"percentile":null},{"date":"2026-10-10T00:00:00.000Z","score":0.002,"percentile":null},{"date":"2026-10-11T00:00:00.000Z","score":0.002,"percentile":null},{"date":"2026-10-12T00:00:00.000Z","score":0.002,"percentile":null},{"date":"2026-10-13T00:00:00.000Z","score":0.002,"percentile":null},{"date":"2026-10-14T00:00:00.000Z","score":0.002,"percentile":null},{"date":"2026-10-15T00:00:00.000Z","score":0.002,"percentile":null},{"date":"2026-10-16T00:00:00.000Z","score":0.002,"percentile":null},{"date":"2026-10-17T00:00:00.000Z","score":0.002,"percentile":null},{"date":"2026-10-18T00:00:00.000Z","score":0.002,"percentile":null},{"date":"2026-10-19T00:00:00.000Z","score":0.002,"percentile":null},{"date":"2026-10-20T00:00:00.000Z","score":0.002,"percentile":0.09334}]},"kev":{"state":"not-listed","entries":[],"listedCount":0,"totalCatalogs":3,"catalogs":[{"source":"cisa","label":"CISA","listed":false,"entry":null},{"source":"enisa","label":"ENISA","listed":false,"entry":null},{"source":"circl","label":"CIRCL","listed":false,"entry":null}]},"ransomware":{"state":"none-recorded","sources":[]},"exploits":[],"exploitCount":0,"weaknesses":[{"id":"CWE-290","name":"Authentication Bypass by Spoofing","description":"This attack-focused weakness is caused by incorrectly implemented authentication schemes that are subject to spoofing attacks.","type":"weakness","status":"Incomplete","abstraction":"Base","likelihoodOfExploit":null,"url":"https://cwe.mitre.org/data/definitions/290.html"}],"affected":[{"vendor":"debian","product":"gnome-shell-extension-gsconnect","name":"gnome-shell-extension-gsconnect","label":"gnome-shell-extension-gsconnect","ecosystem":"Debian","cpePart":null,"purl":"pkg:deb/debian/gnome-shell-extension-gsconnect","purlType":"deb","versions":[{"text":"< 71-1","noFixRecorded":false,"fixedIn":null},{"text":"< 62-1+deb13u1","noFixRecorded":false,"fixedIn":null}],"versionsText":"< 71-1 | < 62-1+deb13u1","eol":null,"hubHref":null},{"vendor":"debian","product":"kdeconnect","name":"kdeconnect","label":"kdeconnect","ecosystem":"Debian","cpePart":null,"purl":"pkg:deb/debian/kdeconnect","purlType":"deb","versions":[{"text":"< 25.11.80+git20251121.7090b106-1","noFixRecorded":false,"fixedIn":null},{"text":"< 25.04.2-1+deb13u1","noFixRecorded":false,"fixedIn":null}],"versionsText":"< 25.11.80+git20251121.7090b106-1 | < 25.04.2-1+deb13u1","eol":null,"hubHref":null},{"vendor":"ubuntu","product":"gnome-shell-extension-gsconnect","name":"gnome-shell-extension-gsconnect","label":"gnome-shell-extension-gsconnect","ecosystem":"Ubuntu","cpePart":null,"purl":"pkg:deb/ubuntu/gnome-shell-extension-gsconnect","purlType":"deb","versions":[{"text":"All versions","noFixRecorded":true,"fixedIn":null}],"versionsText":"All versions (No fix recorded)","eol":null,"hubHref":null},{"vendor":"ubuntu","product":"kdeconnect","name":"kdeconnect","label":"kdeconnect","ecosystem":"Ubuntu","cpePart":null,"purl":"pkg:deb/ubuntu/kdeconnect","purlType":"deb","versions":[{"text":"< 25.08.1-0ubuntu2.1","noFixRecorded":false,"fixedIn":null}],"versionsText":"< 25.08.1-0ubuntu2.1","eol":null,"hubHref":null},{"vendor":"kde","product":"kde connect protocol","name":"KDE Connect protocol","label":"kde connect protocol","ecosystem":null,"cpePart":"a","purl":null,"purlType":null,"versions":[{"text":"8","noFixRecorded":false,"fixedIn":null}],"versionsText":"8","eol":null,"hubHref":"/vendor/kde/kde_connect_protocol"},{"vendor":"opensuse","product":"kdeconnect-kde&distro=openSUSE Tumbleweed","name":"kdeconnect-kde","label":"kdeconnect-kde&distro=openSUSE Tumbleweed","ecosystem":"openSUSE","cpePart":null,"purl":"pkg:rpm/opensuse/kdeconnect-kde&distro=openSUSE Tumbleweed","purlType":"rpm","versions":[{"text":"< 25.11.90-1.1","noFixRecorded":false,"fixedIn":null}],"versionsText":"< 25.11.90-1.1","eol":null,"hubHref":null}],"affectedCount":6,"eol":{"hasEol":false,"count":0},"references":[{"url":"https://invent.kde.org/network/kdeconnect-kde/-/commit/4e53bcdd5d4c28bd9fefd114b807ce35d7b3373e","label":"invent.kde.org/network/kdeconnect-kde/-/commit/4e53bcdd5d4c28bd9fefd114b807ce35d7b3373e","hostname":"invent.kde.org","tags":[]},{"url":"https://invent.kde.org/network/kdeconnect-android/-/commit/675d2d24a1eb95d15d9e5bde2b7e2271d5ada6a9","label":"invent.kde.org/network/kdeconnect-android/-/commit/675d2d24a1eb95d15d9e5bde2b7e2271d5ada6a9","hostname":"invent.kde.org","tags":[]},{"url":"https://invent.kde.org/network/kdeconnect-ios/-/commit/6c003c22d04270cabc4b262d399c753d55cf9080","label":"invent.kde.org/network/kdeconnect-ios/-/commit/6c003c22d04270cabc4b262d399c753d55cf9080","hostname":"invent.kde.org","tags":[]},{"url":"https://github.com/GSConnect/gnome-shell-extension-gsconnect/commit/a38246deec0af50ae218cdc51db32cdd7eb145e3","label":"github.com/GSConnect/gnome-shell-extension-gsconnect/commit/a38246deec0af50ae218cdc51db32cdd7eb145e3","hostname":"github.com","tags":[]},{"url":"https://github.com/andyholmes/valent/commit/85f773124a67ed1add79e7465bb088ec667cccce","label":"github.com/andyholmes/valent/commit/85f773124a67ed1add79e7465bb088ec667cccce","hostname":"github.com","tags":[]},{"url":"https://kde.org/info/security/advisory-20251128-1.txt","label":"kde.org/info/security/advisory-20251128-1.txt","hostname":"kde.org","tags":["REPORT"]},{"url":"https://ubuntu.com/security/CVE-2025-66270","label":"ubuntu.com/security/CVE-2025-66270","hostname":"ubuntu.com","tags":["REPORT"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2025-66270","label":"www.cve.org/CVERecord?id=CVE-2025-66270","hostname":"www.cve.org","tags":["REPORT"]},{"url":"https://ubuntu.com/security/notices/USN-7905-1","label":"ubuntu.com/security/notices/USN-7905-1","hostname":"ubuntu.com","tags":["Advisory"]},{"url":"https://security-tracker.debian.org/tracker/CVE-2025-66270","label":"security-tracker.debian.org/tracker/CVE-2025-66270","hostname":"security-tracker.debian.org","tags":["Advisory"]},{"url":"https://www.suse.com/security/cve/CVE-2025-66270","label":"www.suse.com/security/cve/CVE-2025-66270","hostname":"www.suse.com","tags":["WEB"]}],"lineage":{"upstream":[],"downstream":[],"duplicates":[],"related":[]},"timeline":[{"kind":"published","date":"2025-12-05T00:00:00.000Z","label":"Published","detail":"Vulnerability first disclosed.","source":null},{"kind":"modified","date":"2025-12-05T17:26:40.066Z","label":"Last modified","detail":"Vulnerability information updated.","source":null}],"risk":{"score":19,"level":"low","profile":"Default","thresholds":{"critical":75,"high":50,"medium":25,"low":10}},"meta":{"dataAsOf":"2026-10-21T01:53:05.421Z","stale":false,"partial":false}}