The KDE Connect protocol 8 before 2025-11-28 does not correlate device IDs across two packets. This affects KDE Connect before 25.12 on desktop, KDE Connect before 0.5.4 on iOS, KDE Connect before 1.34.4 on Android, GSConnect before 68, and Valent before 1.0.0.alpha.49.

The remote Ubuntu 25.10 host has packages installed that are affected by a vulnerability as referenced in the USN-7905-1 advisory.

    It was discovered that KDE Connect incorrectly handled device IDs. An attacker could possibly use this     issue to bypass authentication and connect an unpaired device.

Tenable has extracted the preceding description block directly from the Ubuntu security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Debian 13 host has packages installed that are affected by a vulnerability as referenced in the dsa-6066 advisory.

    - -------------------------------------------------------------------------     Debian Security Advisory DSA-6066-1                   security@debian.org     https://www.debian.org/security/                       Moritz Muehlenhoff     November 30, 2025                     https://www.debian.org/security/faq
    - -------------------------------------------------------------------------

    Package        : gnome-shell-extension-gsconnect     CVE ID         : CVE-2025-66270

    It was discovered that missing validation of the device ID during     handshakes in KDE Connect, a tool to integrate smart phones to a     desktop, could allow an attacker to impersonate another device.

    The oldstable distribution (bookworm) is not affected.

    For the stable distribution (trixie), this problem has been fixed in     version 62-1+deb13u1.

    We recommend that you upgrade your gnome-shell-extension-gsconnect packages.

    For the detailed security status of gnome-shell-extension-gsconnect please refer to     its security tracker page at:
    https://security-tracker.debian.org/tracker/gnome-shell-extension-gsconnect

    Further information about Debian Security Advisories, how to apply     these updates to your system and frequently asked questions can be     found at: https://www.debian.org/security/

    Mailing list: debian-security-announce@lists.debian.org

Tenable has extracted the preceding description block directly from the Debian security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Debian 13 host has packages installed that are affected by a vulnerability as referenced in the dsa-6063 advisory.

    - -------------------------------------------------------------------------     Debian Security Advisory DSA-6063-1                   security@debian.org     https://www.debian.org/security/                       Moritz Muehlenhoff     November 26, 2025                     https://www.debian.org/security/faq
    - -------------------------------------------------------------------------

    Package        : kdeconnect     CVE ID         : CVE-2025-66270

    It was discovered that missing validation of the device ID during     handshakes in KDE Connect, a tool to integrate smart phones to a     desktop, could allow an attacker to impersonate another device.

    The oldstable distribution (bookworm) is not affected.

    For the stable distribution (trixie), this problem has been fixed in     version 25.04.2-1+deb13u1.

    We recommend that you upgrade your kdeconnect packages.

    For the detailed security status of kdeconnect please refer to     its security tracker page at:
    https://security-tracker.debian.org/tracker/kdeconnect

    Further information about Debian Security Advisories, how to apply     these updates to your system and frequently asked questions can be     found at: https://www.debian.org/security/

    Mailing list: debian-security-announce@lists.debian.org

Tenable has extracted the preceding description block directly from the Debian security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

  - The KDE Connect protocol 8 before 2025-11-28 does not correlate device IDs across two packets. This     affects KDE Connect before 25.12 on desktop, KDE Connect before 0.5.4 on iOS, KDE Connect before 1.34.4 on     Android, GSConnect before 68, and Valent before 1.0.0.alpha.49. (CVE-2025-66270)

Note that Nessus relies on the presence of the package as reported by the vendor.

ID	Name	Product	Family	Severity
277442	Ubuntu 25.10 : KDE Connect vulnerability (USN-7905-1)	Nessus	Ubuntu Local Security Checks	critical
277296	Debian dsa-6066 : gnome-shell-extension-gsconnect - security update	Nessus	Debian Local Security Checks	critical
277294	Debian dsa-6063 : kdeconnect - security update	Nessus	Debian Local Security Checks	critical
276973	Linux Distros Unpatched Vulnerability : CVE-2025-66270	Nessus	Misc.	critical

Detections

Analytics

CVE-2025-66270

medium

Tenable Plugins

critical

critical

critical

critical