CVE-2025-65885CWE-77command-injection

CVE-2025-65885

Medium · published December 26, 2025

CVSS v3.1
5.1
EPSS
0%
Percentile
2.9
In the wild
Unconfirmed
What it is

An issue was discovered in the Delight Custom Firmware (CFW) for Nokia Symbian Belle devices on Nokia 808 (Delight v1.8), Nokia N8 (Delight v6.7), Nokia E7 (Delight v1.3), Nokia C7 (Delight v6.7), Nokia 700 (Delight v1.2), Nokia 701 (Delight v1.1), Nokia 603 (Delight v1.0), Nokia 500 (Delight v1.2), Nokia E6 (Delight v1.0), Nokia Oro (Delight v1.0), and Vertu Constellation T (Delight v1.0) allowing local attackers to inject startup scripts via crafted .txt files in the :\Data directory.

The record
Technical detail
CVSS v3.1
5.1 · MEDIUM
Vector
CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N
CVSS v4.0
Not supplied
EPSS
0.00138 · 2.9th percentile
Weakness
CWE-77 · Improper Neutralization of Special Elements used in a Command ('Command Injection')
Published
2025-12-26T20:15Z
Affected products (6)
ProductVersionsFixed in
symwld/delight_custom_firmwareall versions—
symwld/delight_custom_firmwareall versions—
symwld/delight_custom_firmwareall versions—
symwld/delight_custom_firmwareall versions—
symwld/delight_custom_firmwareall versions—
symwld/delight_custom_firmwareall versions—
References (2)
https://gist.github.com/symbuzzer/3315e88adc2bba0b6cc66d192b49546d · [email protected]https://www.symwld.com/delight/ · [email protected]
EPSS history
Timeline
  • 26 DEC 00:00Z
    An issue was discovered in the Delight Custom Firmware (CFW) for Nokia Symbian Belle devices on Nokia 808 (Delight v1.8), Nokia N8 (Delight v6.7), Nokia E7…
    cvelistv5