#VU107600 Insufficient verification of data authenticity in KDE.org products - CVE-2025-32900

Vulnerability identifier: #VU107600

Vulnerability risk: Medium

CVSSv4.0: 1.3 [CVSS:4.0/AV:A/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:N/SC:L/SI:N/SA:N/E:U/U:Green]

CVE-ID: CVE-2025-32900

CWE-ID: CWE-345

Exploitation vector: Local network

Exploit availability: No

Vulnerable software:
KDE Connect
Client/Desktop applications / Software for system administration
KDE Connect Android
Mobile applications / Apps for mobile phones
KDE Connect iOS
Mobile applications / Apps for mobile phones

Vendor: KDE.org

Description

The vulnerability allows a remote attacker to impersonate other devices on the network.

The vulnerability exists due to the way KDE Connect handles broadcasts and discovers devices inside the network. A remote attacker on the local network can send broadcast UDP packets that contain display name of another system and perform spoofing attack.

Mitigation
Install updates from vendor's website.

Vulnerable software versions

KDE Connect: 0.1 - 25.03.90

KDE Connect Android: 0.1 - 1.32.11

KDE Connect iOS: 0.3.0 - 0.4.2

---

External links
https://kde.org/info/security/advisory-20250418-2.txt

---

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the local network (LAN).

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.