CRITICAL🇵🇱 Wersja polska

CVE-2025-27034

CVSS 9.8v3.1pub. 2025-09-24upd. 2025-11-28

Memory corruption while selecting the PLMN from SOR failed list.

🤖 AI Analysis
How it works

The error classified as CWE-129 (improper array index validation) occurs during PLMN network selection from the SOR (Steering of Roaming) error list. Improper index validation can lead to writing or reading outside buffer boundaries, resulting in memory corruption. A network attack vector (AV:N) without requiring privileges or user interaction means that the exploit can be remotely triggered by malicious network infrastructure from an operator or a fake base station.

Impact

An attacker can cause memory corruption on the device, potentially gaining the ability to execute arbitrary code (RCE) or destabilizing device operation. Confidentiality, integrity, and availability of the system are threatened to the highest degree.

Mitigation & patch

Patches available from the manufacturer should be applied according to references — details in the Qualcomm security bulletin for September 2025: https://docs.qualcomm.com/product/publicresources/securitybulletin/september-2025-bulletin.html

Who is affected

Qualcomm Snapdragon 765G 5G Mobile Platform (SM7250-AB) Firmware, Qualcomm QCA6574A Firmware, Qualcomm Snapdragon X75 5G Modem-RF System Firmware, Qualcomm WCD9375 Firmware, Qualcomm 315 5G IoT Modem Firmware — versions specified in manufacturer references

Analysis generated by Claude AI (Anthropic) based on NVD data. Always verify with vendor.
CVSS Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

  • Qualcomm 315 5g Iot Modem

    HW
    Qualcomm
    wszystkie wersje

  • Qualcomm 315 5g Iot Modem Firmware

    OS
    Qualcomm
    wszystkie wersje

  • Qualcomm Ar8035

    HW
    Qualcomm
    wszystkie wersje

  • Qualcomm Ar8035 Firmware

    OS
    Qualcomm
    wszystkie wersje

  • Qualcomm Fastconnect 6200

    HW
    Qualcomm
    wszystkie wersje

  • Qualcomm Fastconnect 6200 Firmware

    OS
    Qualcomm
    wszystkie wersje

  • Qualcomm Fastconnect 6700

    HW
    Qualcomm
    wszystkie wersje

  • Qualcomm Fastconnect 6700 Firmware

    OS
    Qualcomm
    wszystkie wersje

  • Qualcomm Fastconnect 6800

    HW
    Qualcomm
    wszystkie wersje

  • Qualcomm Fastconnect 6800 Firmware

    OS
    Qualcomm
    wszystkie wersje

  • Qualcomm Fastconnect 6900

    HW
    Qualcomm
    wszystkie wersje

  • Qualcomm Fastconnect 6900 Firmware

    OS
    Qualcomm
    wszystkie wersje

  • Qualcomm Fastconnect 7800

    HW
    Qualcomm
    wszystkie wersje

  • Qualcomm Fastconnect 7800 Firmware

    OS
    Qualcomm
    wszystkie wersje

  • Qualcomm Qca6174a

    HW
    Qualcomm
    wszystkie wersje

  • Qualcomm Qca6174a Firmware

    OS
    Qualcomm
    wszystkie wersje

  • Qualcomm Qca6391

    HW
    Qualcomm
    wszystkie wersje

  • Qualcomm Qca6391 Firmware

    OS
    Qualcomm
    wszystkie wersje

  • Qualcomm Qca6574a

    HW
    Qualcomm
    wszystkie wersje

  • Qualcomm Qca6574a Firmware

    OS
    Qualcomm
    wszystkie wersje

  • Qualcomm Qca6584au

    HW
    Qualcomm
    wszystkie wersje

  • Qualcomm Qca6584au Firmware

    OS
    Qualcomm
    wszystkie wersje

  • Qualcomm Qca6595au

    HW
    Qualcomm
    wszystkie wersje

  • Qualcomm Qca6595au Firmware

    OS
    Qualcomm
    wszystkie wersje

  • Qualcomm Qca6696

    HW
    Qualcomm
    wszystkie wersje

  • Qualcomm Qca6696 Firmware

    OS
    Qualcomm
    wszystkie wersje

  • Qualcomm Qca6698aq

    HW
    Qualcomm
    wszystkie wersje

  • Qualcomm Qca6698aq Firmware

    OS
    Qualcomm
    wszystkie wersje

  • Qualcomm Qca8081

    HW
    Qualcomm
    wszystkie wersje

  • Qualcomm Qca8081 Firmware

    OS
    Qualcomm
    wszystkie wersje
🔵
CHECK WITH VENDOR
No clear patch data available. Check vendor references.
CWE
References

Related vulnerabilities

CVE-2025-47372CRITICAL9.0PL ✓ten sam produkt

Qualcomm: Memory Corruption przy ładowaniu uszkodzonego obrazu ELF

CVE-2025-21483CRITICAL9.8PL ✓ten sam produkt

Memory corruption w Qualcomm podczas składania pakietów RTP (NALUs)

CVE-2025-21450CRITICAL9.1PL ✓ten sam produkt

Qualcomm: podatność kryptograficzna umożliwiająca Auth Bypass podczas pobierania

CVE-2024-45569CRITICAL9.8PL ✓ten sam produkt

Qualcomm: Uszkodzenie pamięci przy parsowaniu ML IE w firmware

CVE-2024-33066CRITICAL9.8PL ✓ten sam produkt

Qualcomm Snapdragon – memory corruption przy przekierowaniu pliku logów