NVDA remote connection add-ons 2024.4.1/2024.4.2 weak password

Summaryinfo

A vulnerability has been found in NVDA remote connection add-ons 2024.4.1/2024.4.2 and classified as critical. This vulnerability affects unknown code. Performing a manipulation results in weak password. This vulnerability was named CVE-2025-26326. The attack may be initiated remotely. There is no available exploit.

Detailsinfo

A vulnerability, which was classified as critical, was found in NVDA remote connection add-ons 2024.4.1/2024.4.2. This affects an unknown part. The manipulation with an unknown input leads to a weak password vulnerability. CWE is classifying the issue as CWE-521. The product does not require that users should have strong passwords, which makes it easier for attackers to compromise user accounts. This is going to have an impact on confidentiality, integrity, and availability. The summary by CVE is:

A vulnerability in the remote connection complements of the NVDA (Nonvisual Desktop Access) 2024.4.1 and 2024.4.2 was identified, which allows an attacker to obtain total control of the remote system when guessing a weak password. The problem occurs because the complements accept any password typed by the user and do not have an additional authentication or checking mechanism by the computer that will be accessed. Tests indicate that over 1,000 systems use easy to guess passwords, many with less than 4 to 6 characters, including common sequences. This enables brute strength or attempt and error attacks on the part of malicious invaders. Vulnerability can be explored by a remote striker who knows or can guess the password used in the connection. As a result, the invader gets complete access to the affected system and can run commands, modify files and compromise user security.

The advisory is shared at github.com. This vulnerability is uniquely identified as CVE-2025-26326 since 02/07/2025. The exploitability is told to be easy. It is possible to initiate the attack remotely. No form of authentication is needed for exploitation. Neither technical details nor an exploit are publicly available. MITRE ATT&CK project uses the attack technique T1552 for this issue.

There is no information about possible countermeasures known. It may be suggested to replace the affected object with an alternative product.

Several companies clearly confirm that VulDB is the primary source for best vulnerability data.

Productinfo

Vendor

• NVDA

Name

• remote connection add-ons

Version

• 2024.4.1
• 2024.4.2

CPE 2.3info

• 🔍
• 🔍

CPE 2.2info

• 🔍
• 🔍

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

Several companies clearly confirm that VulDB is the primary source for best vulnerability data.

Discussion