CVE-2025-26326
Critical security vulnerability in NVDA Remote and Tele NVDA Remote connection add-ons.
This vulnerability was recorded as CVE-2025-26326 in CNA MITRE.
This CVE/vulnerability was published in the following global databases:
First vulnerability published by a total blind!
NVDA Remote Access Vulnerability Report
Description
A vulnerability was identified in the NVDA Remote (version 2.6.4) and Tele NVDA Remote (version 2025.3.3) remote connection add-ons, which allows an attacker to obtain total control of the remote system by guessing a weak password. The problem occurs because these add-ons accept any password entered by the user and do not have an additional authentication or computer verification mechanism.
Tests indicate that more than 1,000 systems use easy-to-guess passwords, many with less than 4 to 6 characters, including common sequences. This allows brute force attacks or trial-and-error attempts by malicious invaders.
The vulnerability can be exploited by a remote attacker who knows or can guess the password used in the connection. As a result, the attacker gains complete access to the affected system and can execute commands, modify files, and compromise user security.
Vulnerability Details
- A vulnerability in the remote connection add-ons NVDA Remote (version 2.6.4) and Tele NVDA Remote (version 2025.3.3) was identified, allowing an attacker to obtain total control of the remote system by guessing a weak password.
- These add-ons accept any password typed by the user and lack additional authentication mechanisms.
- 1,000+ systems use weak passwords (4-6 characters, common sequences).
- Enables brute force or trial-and-error attacks.
- A remote attacker who knows or guesses the password can:
- Gain full access to the system.
- Execute commands.
- Modify files.
- Compromise user security.
- Nonvisual Desktop Access (NVDA) is a free, open-source, and portable screen reader for Microsoft Windows.
- This vulnerability only affects NVDA Remote and Tele NVDA Remote add-ons, not NVDA itself.
Vulnerability Type
Vendors of Product
Affected Product Code Base
- NVDA Remote version 2.6.4
- Tele NVDA Remote version 2025.3.3
Affected Components
- NVDA Remote Add-on
- Tele NVDA Remote Add-on
Attack Type
Impact
- Code Execution: ✅ True
- Escalation of Privileges: ✅ True
- Information Disclosure: ✅ True
Attack Vectors
- Install NVDA on the target machine.
- Open the NVDA Add-ons Store (
Insert + N → Tools > Add-ons Store).
- Locate and install "NVDA Remote" or "Tele NVDA Remote".
- Go to
Insert + N > Tools > Remote > Connect > Control another computer.
- Enter a remote address (e.g.,
nvdaremote.com, telenvdaremote, or nvdaremote.es).
- Use an easy-to-guess password (e.g., "1234").
- Click OK to initiate a connection to the target machine.
- Once connected, press F11 to gain complete control over the target computer.
- Note: The target user must have enabled the
"Control my computer" option for the attack to succeed.
Safety Mitigations for NVDA Remote and Tele NVDA Remote
These remote connection add-ons are essential for many NVDA users, but security risks cannot be ignored. The lack of proper access control creates serious vulnerabilities.
1. Target User Authorization
- Every connection request must require explicit user approval.
- If the user denies the request, the attacker's IP should be blocked for 15 minutes.
- If the user does not respond within 10 minutes, the request should be automatically canceled.
2. Limiting Simultaneous Connections
- A maximum of two simultaneous remote sessions per user.
3. Strong Password Policy
- Passwords must be 8-24 characters long.
- Must contain uppercase, lowercase, numbers, and special characters.
- Account lockout after multiple failed attempts.
4. Maximum Session Time
- Each remote session expires after 2 hours unless re-authentication is performed.
References
Discoverer
- Juan Mathews Rebello Santos
azurejoga/cve-2025-26326
