CVE-2025-32899
BaseFortify
Publication date: 2025-12-05
Last updated on: 2025-12-08
Assigner: MITRE
Description
Description
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| kde | kde_connect | 1.33.0 |
Helpful Resources
Exploitability
| CWE ID | Description |
|---|---|
| CWE-1250 | The product has or supports multiple distributed components or sub-systems that are each required to keep their own local copy of shared data - such as state or cache - but the product does not ensure that all local copies remain consistent with each other. |
Attack-Flow Graph
AI Powered Q&A
Can you explain this vulnerability to me?
This vulnerability in KDE Connect before version 1.33.0 on Android allows an attacker to send a specially crafted invalid discovery packet over broadcast UDP, which causes two paired devices to unpair unexpectedly.
How can this vulnerability impact me? :
The impact of this vulnerability is that an attacker can cause paired devices to unpair without user interaction, potentially disrupting device connectivity and communication.
How can this vulnerability be detected on my network or system? Can you suggest some commands?
This vulnerability involves crafted invalid discovery packets sent over broadcast UDP that cause paired devices to unpair. Detection can involve monitoring broadcast UDP traffic on the network for unusual or malformed discovery packets targeting KDE Connect devices. Using network packet capture tools like tcpdump or Wireshark, you can filter for UDP broadcast packets on the ports used by KDE Connect (commonly UDP port 1716). For example, a command to capture such packets could be: tcpdump -i <interface> udp and dst port 1716 and broadcast. Analyzing these packets for invalid or malformed discovery packets may indicate exploitation attempts. [1]
What immediate steps should I take to mitigate this vulnerability?
Immediate mitigation steps include avoiding the use of KDE Connect on untrusted networks such as public Wi-Fi at airports or conferences to reduce exposure to crafted malicious UDP discovery packets. The definitive solution is to update the KDE Connect Android application to version 1.33.0 or later, which contains the fix for this vulnerability. [1]