CVE-2025-32900 Overview
CVE-2025-32900 affects the KDE Connect information-exchange protocol prior to the 2025-04-18 fix. An attacker on the same local network can craft a broadcast UDP packet that temporarily changes the displayed information about a paired device. The flaw stems from reliance on unauthenticated broadcast UDP for identity presentation [CWE-348: Use of Less Trusted Source]. The issue affects KDE Connect before 1.33.0 on Android, KDE Connect before 25.04 on desktop, KDE Connect before 0.5 on iOS, Valent before 1.0.0.alpha.47, and GSConnect before 59.
Critical Impact
An adjacent-network attacker can spoof device identity metadata displayed to users, enabling targeted social-engineering against KDE Connect clients.
Affected Products
- KDE Connect before 1.33.0 (Android)
- KDE Connect before 25.04 (desktop) and before 0.5 (iOS)
- Valent before 1.0.0.alpha.47 and GSConnect before 59
Discovery Timeline
- 2025-04-18 - KDE Security Advisory published
- 2025-12-05 - CVE-2025-32900 published to NVD
- 2026-06-17 - Last updated in NVD database
Technical Details for CVE-2025-32900
Vulnerability Analysis
KDE Connect pairs devices across a local network and exchanges presentation metadata such as device name, type, and capabilities. The information-exchange protocol uses broadcast UDP without origin authentication for identity packets. Any host on the same broadcast domain can emit a crafted identity packet that a receiving client renders in its user interface.
The displayed-information change is temporary, but it occurs on genuine, previously-trusted client state. An attacker can use this to impersonate a trusted device name or type long enough to coerce user actions such as approving file transfers, clipboard sync, or remote input prompts.
Root Cause
The root cause is trust placed in an unauthenticated transport. Broadcast UDP packets carry no cryptographic binding to a verified device identity, so the receiver has no way to distinguish a legitimate advertisement from a spoofed one. This maps to [CWE-348: Use of Less Trusted Source], where the application accepts and displays data from a channel that cannot be authenticated.
Attack Vector
Exploitation requires adjacent-network access to the same Layer 2 broadcast domain, such as a shared Wi-Fi network. The attacker sends a crafted UDP identity packet to the KDE Connect discovery port. Receiving KDE Connect, Valent, or GSConnect clients update displayed device metadata based on that packet. No user interaction or authentication is required on the victim side to trigger the display change.
Refer to the KDE Security Advisory 2025-04-18 for protocol-level details.
Detection Methods for CVE-2025-32900
Indicators of Compromise
- Unexpected changes to a paired device's displayed name, icon, or type within a KDE Connect, Valent, or GSConnect client.
- Duplicate device entries appearing on the local network with identical or near-identical identifiers.
- Unsolicited pairing or capability prompts shortly after joining a shared Wi-Fi network.
Detection Strategies
- Monitor UDP traffic on the KDE Connect discovery port (default 1716) for broadcast packets originating from unexpected MAC or IP addresses.
- Correlate device-identity advertisements against a known-good inventory of paired KDE Connect devices.
- Alert on multiple identity packets claiming the same device ID from differing source addresses within a short window.
Monitoring Recommendations
- Enable host-based logging where supported to capture KDE Connect pairing and identity-update events.
- On managed networks, use wireless intrusion detection to flag spoofed broadcast activity on guest and BYOD segments.
- Review KDE Connect version inventory across Android, Linux desktop, and iOS endpoints to identify unpatched clients.
How to Mitigate CVE-2025-32900
Immediate Actions Required
- Upgrade KDE Connect to 1.33.0 or later on Android and 25.04 or later on desktop, and update iOS clients to 0.5 or later.
- Upgrade Valent to 1.0.0.alpha.47 or later and GSConnect to version 59 or later.
- Restrict KDE Connect usage to trusted networks and avoid pairing on public or shared Wi-Fi.
Patch Information
Fixes are available in the versions listed above. Consult the KDE Security Advisory 2025-04-18 and the KDE Connect project site for release notes and distribution-specific package availability.
Workarounds
- Block UDP port 1716 on untrusted network segments using host or network firewalls.
- Disable KDE Connect, Valent, or GSConnect on systems that do not require cross-device integration.
- Use client-isolation (AP isolation) on wireless networks to prevent peer-to-peer broadcast traffic between endpoints.
# Example: block KDE Connect discovery/traffic on Linux with ufw
sudo ufw deny in proto udp to any port 1714:1764
sudo ufw deny in proto tcp to any port 1714:1764
sudo ufw reload
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
