CVE-2025-26326
Quick assessment
Affected
n/a n/a
Exploitation
Public or AI PoC available; prioritize validation
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.
NVDA（Nonvisual Desktop Access）是NV Access开源的一个非视觉桌面访问系统。 NVDA 2024.4.1版本和2024.4.2版本存在安全漏洞，该漏洞源于远程连接组件接受弱密码，可能导致系统被完全控制。
Possible ATT&CK Techniques 3 AI
T1133 · External Remote Services T1078 · Valid Accounts T1110.001 · Password Guessing
Get alerts for future matching vulnerabilities
Log in to subscribe
I. Basic Information for CVE-2025-26326
Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗
Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.
Vulnerability Title
N/A
Source: CVE Program / CVE List V5
Vulnerability Description
A vulnerability was identified in the NVDA Remote (version 2.6.4) and Tele NVDA Remote (version 2025.3.3) remote connection add-ons, which allows an attacker to obtain total control of the remote system by guessing a weak password. The problem occurs because these add-ons accept any password entered by the user and do not have an additional authentication or computer verification mechanism. Tests indicate that more than 1,000 systems use easy-to-guess passwords, many with less than 4 to 6 characters, including common sequences. This allows brute force attacks or trial-and-error attempts by malicious invaders. The vulnerability can be exploited by a remote attacker who knows or can guess the password used in the connection. As a result, the attacker gains complete access to the affected system and can execute commands, modify files, and compromise user security.
Source: CVE Program / CVE List V5
CVSS Information
N/A
Source: CVE Program / CVE List V5
Vulnerability Type
N/A
Source: CVE Program / CVE List V5
Vulnerability Title
NVDA 安全漏洞
Source: CNNVD (China National Vulnerability Database)
Vulnerability Description
NVDA（Nonvisual Desktop Access）是NV Access开源的一个非视觉桌面访问系统。 NVDA 2024.4.1版本和2024.4.2版本存在安全漏洞，该漏洞源于远程连接组件接受弱密码，可能导致系统被完全控制。
Source: CNNVD (China National Vulnerability Database)
CVSS Information
N/A
Source: CNNVD (China National Vulnerability Database)
Vulnerability Type
N/A
Source: CNNVD (China National Vulnerability Database)
Affected Products
| Vendor | Product | Affected Versions | CPE | Subscribe |
|---|---|---|---|---|
| - | n/a | n/a | - |
|
II. Public POCs for CVE-2025-26326
| # | POC Description | Source Link | Shenlong Link |
|---|---|---|---|
| 1 | Critical security vulnerability in NVDA remote connection add-ons. | https://github.com/azurejoga/CVE-2025-26326 | POC Details |
AI-Generated POC
Premium
No public POC found.
Login to generate AI POCIII. Intelligence Information for CVE-2025-26326
请登录查看更多情报信息。
Proof of Concept for CVE-2025-26326 (1)
Vendor Pages for CVE-2025-26326 (1)
Other References for CVE-2025-26326 (4)
Same Patch Batch · n/a · 2025-02-28 · 17 CVEs total
| CVE-2025-25916 | WUZHI CMS 安全漏洞 | |
| CVE-2025-25461 | SeedDMS 安全漏洞 | |
| CVE-2024-44754 | Minut M2 安全漏洞 | |
| CVE-2025-26047 | Loggrove 安全漏洞 | |
| CVE-2025-26263 | GeoVision ASManager 安全漏洞 | |
| CVE-2025-25431 | TRENDnet TEW-929DRU 安全漏洞 | |
| CVE-2025-25430 | Trendnet TEW-929DRU 安全漏洞 | |
| CVE-2025-25429 | TRENDnet TEW-929DRU 安全漏洞 | |
| CVE-2025-25428 | TRENDnet TEW-929DRU 安全漏洞 | |
| CVE-2025-25635 | TOTOlink A3002R 安全漏洞 | |
| CVE-2025-25609 | TOTOlink A3002R 安全漏洞 | |
| CVE-2025-25610 | TOTOLINK A3002R 安全漏洞 | |
| CVE-2025-25478 | SysPass 安全漏洞 | |
| CVE-2025-25476 | SysPass 跨站脚本漏洞 | |
| CVE-2025-25379 | 07FLYCMS 跨站请求伪造漏洞 | |
| CVE-2025-25723 | GPAC 安全漏洞 |
IV. Related Vulnerabilities
V. Comments for CVE-2025-26326
No comments yet