CVE-2025-47357CWE-306

CVE-2025-47357

High ยท published November 4, 2025

CVSS v3.1
8.0
EPSS
0%
Percentile
0.1
In the wild
Unconfirmed
What it is

โšก User-level drivers are leaking secrets! These QFPROM read or write operations can expose sensitive Fuse region data โ€” talk about a surprise party nobody asked for! ๐ŸŽ‰ Think of it like a waiter who accidentally spills the contents of your confidential order to the table next door โ€” private information floating around when it shouldn't be. The Fuse regions are those precious recipes meant to stay under wraps! If exploited, an attacker could gain unauthorized access to sensitive information, potentially leading to significant security breaches. This means your data could be out in the wild, opening the door for all sorts of malicious activities. Yikes!

Put simply

Think of it like a waiter who accidentally spills the contents of your confidential order to the table next door โ€” private information floating around when it shouldn't be. The Fuse regions are those precious recipes meant to stay under wraps! This vulnerability arises from improper handling of information when a user-level driver performs operations on QFPROM Fuse regions, allowing unauthorized reading or writing of potentially sensitive data.

What to do

If exploited, an attacker could gain unauthorized access to sensitive information, potentially leading to significant security breaches. This means your data could be out in the wild, opening the door for all sorts of malicious activities. Yikes! To remediate this vulnerability, ensure you patch to the latest driver version provided by the manufacturer. Additionally, review and restrict access to user-level drivers to minimize exposure. Regular audits can also help catch any sneaky access attempts. You've got this! With a little diligence and the right patches, you'll keep your secrets safe and sound! ๐Ÿ›ก๏ธ

The record
Technical detail
CVSS v3.1
8.0 ยท HIGH
Vector
CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:H
CVSS v4.0
Not supplied
EPSS
0.00078 ยท 0.1th percentile
Weakness
CWE-306 ยท Missing Authentication for Critical Function
Published
2025-11-04T09:15Z
Affected products (24)
ProductVersionsFixed in
qualcomm/qam8255p_firmwareall versionsโ€”
qualcomm/qam8620p_firmwareall versionsโ€”
qualcomm/qam8650p_firmwareall versionsโ€”
qualcomm/qam8775p_firmwareall versionsโ€”
qualcomm/qamsrv1h_firmwareall versionsโ€”
qualcomm/qamsrv1m_firmwareall versionsโ€”
qualcomm/qca6595_firmwareall versionsโ€”
qualcomm/qca6595au_firmwareall versionsโ€”
qualcomm/qca6678aq_firmwareall versionsโ€”
qualcomm/qca6696_firmwareall versionsโ€”
qualcomm/qca6698aq_firmwareall versionsโ€”
qualcomm/qca6797aq_firmwareall versionsโ€”
qualcomm/qcs9100_firmwareall versionsโ€”
qualcomm/sa7255p_firmwareall versionsโ€”
qualcomm/sa7775p_firmwareall versionsโ€”
qualcomm/sa8255p_firmwareall versionsโ€”
qualcomm/sa8620p_firmwareall versionsโ€”
qualcomm/sa8650p_firmwareall versionsโ€”
qualcomm/sa8770p_firmwareall versionsโ€”
qualcomm/sa8775p_firmwareall versionsโ€”
qualcomm/sa9000p_firmwareall versionsโ€”
qualcomm/srv1h_firmwareall versionsโ€”
qualcomm/srv1l_firmwareall versionsโ€”
qualcomm/srv1m_firmwareall versionsโ€”
References (1)
EPSS history
Timeline
  • 04 NOV 03:19Z
    Missing Authentication for Critical Function in SMSS
    cvelistv5