Action not permitted
Modal body text goes here.
Modal Title
Modal Body
CVE-2025-20751 (GCVE-0-2025-20751)
Vulnerability from cvelistv5 – Published: 2025-12-02 02:34 – Updated: 2025-12-02 14:46
VLAI?
EPSS
Summary
In Modem, there is a possible system crash due to a missing bounds check. This could lead to remote denial of service, if a UE has connected to a rogue base station controlled by the attacker, with no additional execution privileges needed. User interaction is not needed for exploitation. Patch ID: MOLY01661195; Issue ID: MSV-4297.
Severity ?
5.3 (Medium)
CWE
- CWE-787 - Out-of-bounds Write
Assigner
References
Impacted products
{
"containers": {
"adp": [
{
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "HIGH",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 5.3,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
}
},
{
"other": {
"content": {
"id": "CVE-2025-20751",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2025-12-02T14:46:50.131464Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2025-12-02T14:46:55.781Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"product": "MT2735, MT6833, MT6833P, MT6853, MT6853T, MT6855, MT6855T, MT6873, MT6875, MT6875T, MT6877, MT6877T, MT6877TT, MT6880, MT6883, MT6885, MT6889, MT6890, MT6891, MT6893, MT8675, MT8771, MT8791, MT8791T, MT8797",
"vendor": "MediaTek, Inc.",
"versions": [
{
"status": "affected",
"version": "Modem NR15"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In Modem, there is a possible system crash due to a missing bounds check. This could lead to remote denial of service, if a UE has connected to a rogue base station controlled by the attacker, with no additional execution privileges needed. User interaction is not needed for exploitation. Patch ID: MOLY01661195; Issue ID: MSV-4297."
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-787",
"description": "CWE-787 Out-of-bounds Write",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2025-12-02T02:34:21.596Z",
"orgId": "ee979b05-11f8-4f25-a7e0-a1fa9c190374",
"shortName": "MediaTek"
},
"references": [
{
"url": "https://corp.mediatek.com/product-security-bulletin/December-2025"
}
]
}
},
"cveMetadata": {
"assignerOrgId": "ee979b05-11f8-4f25-a7e0-a1fa9c190374",
"assignerShortName": "MediaTek",
"cveId": "CVE-2025-20751",
"datePublished": "2025-12-02T02:34:21.596Z",
"dateReserved": "2024-11-01T01:21:50.396Z",
"dateUpdated": "2025-12-02T14:46:55.781Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2",
"vulnerability-lookup:meta": {
"nvd": "{\"cve\":{\"id\":\"CVE-2025-20751\",\"sourceIdentifier\":\"security@mediatek.com\",\"published\":\"2025-12-02T03:16:16.213\",\"lastModified\":\"2025-12-04T13:54:15.220\",\"vulnStatus\":\"Analyzed\",\"cveTags\":[],\"descriptions\":[{\"lang\":\"en\",\"value\":\"In Modem, there is a possible system crash due to a missing bounds check. This could lead to remote denial of service, if a UE has connected to a rogue base station controlled by the attacker, with no additional execution privileges needed. User interaction is not needed for exploitation. Patch ID: MOLY01661195; Issue ID: MSV-4297.\"}],\"metrics\":{\"cvssMetricV31\":[{\"source\":\"134c704f-9b21-4f2e-91b3-4a467353bcc0\",\"type\":\"Secondary\",\"cvssData\":{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:H\",\"baseScore\":5.3,\"baseSeverity\":\"MEDIUM\",\"attackVector\":\"NETWORK\",\"attackComplexity\":\"HIGH\",\"privilegesRequired\":\"LOW\",\"userInteraction\":\"NONE\",\"scope\":\"UNCHANGED\",\"confidentialityImpact\":\"NONE\",\"integrityImpact\":\"NONE\",\"availabilityImpact\":\"HIGH\"},\"exploitabilityScore\":1.6,\"impactScore\":3.6}]},\"weaknesses\":[{\"source\":\"security@mediatek.com\",\"type\":\"Secondary\",\"description\":[{\"lang\":\"en\",\"value\":\"CWE-787\"}]}],\"configurations\":[{\"operator\":\"AND\",\"nodes\":[{\"operator\":\"OR\",\"negate\":false,\"cpeMatch\":[{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:mediatek:nr15:-:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"E30A2D2E-6A72-4070-A471-EEE75F7D07F2\"}]},{\"operator\":\"OR\",\"negate\":false,\"cpeMatch\":[{\"vulnerable\":false,\"criteria\":\"cpe:2.3:h:mediatek:mt2735:-:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"7F1D09FC-5BE9-4B23-82F1-3C6EAC5711A6\"},{\"vulnerable\":false,\"criteria\":\"cpe:2.3:h:mediatek:mt6833:-:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"9814939B-F05E-4870-90C0-7C0F6BAAEB39\"},{\"vulnerable\":false,\"criteria\":\"cpe:2.3:h:mediatek:mt6833p:-:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"CB690F5A-9367-45D3-A53E-80BF60053630\"},{\"vulnerable\":false,\"criteria\":\"cpe:2.3:h:mediatek:mt6853:-:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"366F1912-756B-443E-9962-224937DD7DFB\"},{\"vulnerable\":false,\"criteria\":\"cpe:2.3:h:mediatek:mt6853t:-:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"328DA6BE-1303-4646-89B7-2EC8DC444532\"},{\"vulnerable\":false,\"criteria\":\"cpe:2.3:h:mediatek:mt6855:-:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"89AFEE24-7AAD-4EDB-8C3E-EDBA3240730A\"},{\"vulnerable\":false,\"criteria\":\"cpe:2.3:h:mediatek:mt6855t:-:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"083F6134-FF26-4F1B-9B77-971D342AF774\"},{\"vulnerable\":false,\"criteria\":\"cpe:2.3:h:mediatek:mt6873:-:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"F6B8A36E-C5FB-44AE-A1C3-50EBF4C68F6B\"},{\"vulnerable\":false,\"criteria\":\"cpe:2.3:h:mediatek:mt6875:-:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"80BDC5EC-E822-4BC7-8C0D-E8AD8396E8FE\"},{\"vulnerable\":false,\"criteria\":\"cpe:2.3:h:mediatek:mt6875t:-:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"F883C6D3-1724-4553-9EFC-3D204FF3CAA3\"},{\"vulnerable\":false,\"criteria\":\"cpe:2.3:h:mediatek:mt6877:-:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"7CA9352F-E9BD-4656-9B7C-4AFEE2C78E58\"},{\"vulnerable\":false,\"criteria\":\"cpe:2.3:h:mediatek:mt6877t:-:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"EFA54AA1-4E3A-44F8-A222-31C60F8F81DA\"},{\"vulnerable\":false,\"criteria\":\"cpe:2.3:h:mediatek:mt6877tt:-:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"5D4D6885-E18C-477F-8B6D-B9E84D9535E2\"},{\"vulnerable\":false,\"criteria\":\"cpe:2.3:h:mediatek:mt6880:-:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"68CF4A7A-3136-4C4C-A795-81323896BE11\"},{\"vulnerable\":false,\"criteria\":\"cpe:2.3:h:mediatek:mt6883:-:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"15E2EC3F-9FB3-488B-B1C1-2793A416C755\"},{\"vulnerable\":false,\"criteria\":\"cpe:2.3:h:mediatek:mt6885:-:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"DD64413C-C774-4C4F-9551-89E1AA9469EE\"},{\"vulnerable\":false,\"criteria\":\"cpe:2.3:h:mediatek:mt6889:-:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"3B787DC3-8E5A-4968-B20B-37B6257FAAE2\"},{\"vulnerable\":false,\"criteria\":\"cpe:2.3:h:mediatek:mt6890:-:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"171D1C08-F055-44C0-913C-AA2B73AF5B72\"},{\"vulnerable\":false,\"criteria\":\"cpe:2.3:h:mediatek:mt6891:-:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"D8E91CA4-CA5B-40D1-9A96-2B875104BCF4\"},{\"vulnerable\":false,\"criteria\":\"cpe:2.3:h:mediatek:mt6893:-:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"213B5C7F-D965-4312-9CDF-4F06FA77D401\"},{\"vulnerable\":false,\"criteria\":\"cpe:2.3:h:mediatek:mt8675:-:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"03E6123A-7603-4EAB-AFFB-229E8A040709\"},{\"vulnerable\":false,\"criteria\":\"cpe:2.3:h:mediatek:mt8771:-:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"0D09F23D-D023-4A60-B426-61251FDD8A5A\"},{\"vulnerable\":false,\"criteria\":\"cpe:2.3:h:mediatek:mt8791:-:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"9CD2C3EC-B62D-4616-964F-FDBE5B14A449\"},{\"vulnerable\":false,\"criteria\":\"cpe:2.3:h:mediatek:mt8791t:-:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"1BB05B1D-77C9-4E42-91AD-9F087413DC20\"},{\"vulnerable\":false,\"criteria\":\"cpe:2.3:h:mediatek:mt8797:-:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"2B469BF4-5961-42E9-814B-1BE06D182E45\"}]}]}],\"references\":[{\"url\":\"https://corp.mediatek.com/product-security-bulletin/December-2025\",\"source\":\"security@mediatek.com\",\"tags\":[\"Vendor Advisory\"]}]}}",
"vulnrichment": {
"containers": "{\"adp\": [{\"title\": \"CISA ADP Vulnrichment\", \"metrics\": [{\"cvssV3_1\": {\"scope\": \"UNCHANGED\", \"version\": \"3.1\", \"baseScore\": 5.3, \"attackVector\": \"NETWORK\", \"baseSeverity\": \"MEDIUM\", \"vectorString\": \"CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:H\", \"integrityImpact\": \"NONE\", \"userInteraction\": \"NONE\", \"attackComplexity\": \"HIGH\", \"availabilityImpact\": \"HIGH\", \"privilegesRequired\": \"LOW\", \"confidentialityImpact\": \"NONE\"}}, {\"other\": {\"type\": \"ssvc\", \"content\": {\"id\": \"CVE-2025-20751\", \"role\": \"CISA Coordinator\", \"options\": [{\"Exploitation\": \"none\"}, {\"Automatable\": \"no\"}, {\"Technical Impact\": \"partial\"}], \"version\": \"2.0.3\", \"timestamp\": \"2025-12-02T14:46:50.131464Z\"}}}], \"providerMetadata\": {\"orgId\": \"134c704f-9b21-4f2e-91b3-4a467353bcc0\", \"shortName\": \"CISA-ADP\", \"dateUpdated\": \"2025-12-02T14:46:43.710Z\"}}], \"cna\": {\"affected\": [{\"vendor\": \"MediaTek, Inc.\", \"product\": \"MT2735, MT6833, MT6833P, MT6853, MT6853T, MT6855, MT6855T, MT6873, MT6875, MT6875T, MT6877, MT6877T, MT6877TT, MT6880, MT6883, MT6885, MT6889, MT6890, MT6891, MT6893, MT8675, MT8771, MT8791, MT8791T, MT8797\", \"versions\": [{\"status\": \"affected\", \"version\": \"Modem NR15\"}]}], \"references\": [{\"url\": \"https://corp.mediatek.com/product-security-bulletin/December-2025\"}], \"descriptions\": [{\"lang\": \"en\", \"value\": \"In Modem, there is a possible system crash due to a missing bounds check. This could lead to remote denial of service, if a UE has connected to a rogue base station controlled by the attacker, with no additional execution privileges needed. User interaction is not needed for exploitation. Patch ID: MOLY01661195; Issue ID: MSV-4297.\"}], \"problemTypes\": [{\"descriptions\": [{\"lang\": \"en\", \"type\": \"CWE\", \"cweId\": \"CWE-787\", \"description\": \"CWE-787 Out-of-bounds Write\"}]}], \"providerMetadata\": {\"orgId\": \"ee979b05-11f8-4f25-a7e0-a1fa9c190374\", \"shortName\": \"MediaTek\", \"dateUpdated\": \"2025-12-02T02:34:21.596Z\"}}}",
"cveMetadata": "{\"cveId\": \"CVE-2025-20751\", \"state\": \"PUBLISHED\", \"dateUpdated\": \"2025-12-02T14:46:55.781Z\", \"dateReserved\": \"2024-11-01T01:21:50.396Z\", \"assignerOrgId\": \"ee979b05-11f8-4f25-a7e0-a1fa9c190374\", \"datePublished\": \"2025-12-02T02:34:21.596Z\", \"assignerShortName\": \"MediaTek\"}",
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
}
}
GHSA-G4J5-G27H-V622
Vulnerability from github – Published: 2025-12-02 03:31 – Updated: 2025-12-02 15:30
VLAI?
Details
In Modem, there is a possible system crash due to a missing bounds check. This could lead to remote denial of service, if a UE has connected to a rogue base station controlled by the attacker, with no additional execution privileges needed. User interaction is not needed for exploitation. Patch ID: MOLY01661195; Issue ID: MSV-4297.
Severity ?
5.3 (Medium)
{
"affected": [],
"aliases": [
"CVE-2025-20751"
],
"database_specific": {
"cwe_ids": [
"CWE-787"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2025-12-02T03:16:16Z",
"severity": "MODERATE"
},
"details": "In Modem, there is a possible system crash due to a missing bounds check. This could lead to remote denial of service, if a UE has connected to a rogue base station controlled by the attacker, with no additional execution privileges needed. User interaction is not needed for exploitation. Patch ID: MOLY01661195; Issue ID: MSV-4297.",
"id": "GHSA-g4j5-g27h-v622",
"modified": "2025-12-02T15:30:30Z",
"published": "2025-12-02T03:31:44Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2025-20751"
},
{
"type": "WEB",
"url": "https://corp.mediatek.com/product-security-bulletin/December-2025"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:H",
"type": "CVSS_V3"
}
]
}
NCSC-2025-0379
Vulnerability from csaf_ncscnl - Published: 2025-12-02 13:25 - Updated: 2025-12-02 13:25Summary
Kwetsbaarheden verholpen in Google Android en Samsung Mobile
Notes
The Netherlands Cyber Security Center (henceforth: NCSC-NL) maintains this page to enhance access to its information and security advisories. The use of this security advisory is subject to the following terms and conditions:
NCSC-NL makes every reasonable effort to ensure that the content of this page is kept up to date, and that it is accurate and complete. Nevertheless, NCSC-NL cannot entirely rule out the possibility of errors, and therefore cannot give any warranty in respect of its completeness, accuracy or continuous keeping up-to-date. The information contained in this security advisory is intended solely for the purpose of providing general information to professional users. No rights can be derived from the information provided therein.
NCSC-NL and the Kingdom of the Netherlands assume no legal liability or responsibility for any damage resulting from either the use or inability of use of this security advisory. This includes damage resulting from the inaccuracy of incompleteness of the information contained in the advisory.
This security advisory is subject to Dutch law. All disputes related to or arising from the use of this advisory will be submitted to the competent court in The Hague. This choice of means also applies to the court in summary proceedings.
Feiten
Google heeft kwetsbaarheden verholpen in Android. Samsung heeft de voor Samsung mobile relevante kwetsbaarheden verholpen in Samsung mobile.
Interpretaties
De kwetsbaarheden zijn voornamelijk gerelateerd aan onjuiste invoervalidatie, wat kan resulteren in systeemcrashes en remote denial of service-aanvallen via kwaadaardige basisstations zonder dat gebruikersinteractie vereist is. Dit vormt een risico voor de stabiliteit en integriteit van de systemen die deze technologie gebruiken.
Google meldt informatie te hebben ontvangen dat de kwetsbaarheden met kenmerk CVE-2025-48633 en CVE-2025-48572 beperkt en gericht zijn misbruikt. Deze kwetsbaarheden bevinden zich in het Android Framework en stellen een kwaadwillende in staat zich verhoogde rechten toe te kennen en toegang te krijgen tot gevoelige gegevens. Voor zover bekend moet voor succesvol misbruik de kwaadwillende het slachtoffer misleiden een malafide app te installeren.
Oplossingen
Google en Samsung hebben patches uitgebracht om de kwetsbaarheden te verhelpen. Zie bijgevoegde referenties voor meer informatie.
Kans
medium
Schade
high
CWE-20
Improper Input Validation
CWE-78
Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')
CWE-122
Heap-based Buffer Overflow
CWE-125
Out-of-bounds Read
CWE-131
Incorrect Calculation of Buffer Size
CWE-190
Integer Overflow or Wraparound
CWE-248
Uncaught Exception
CWE-280
Improper Handling of Insufficient Permissions or Privileges
CWE-287
Improper Authentication
CWE-404
Improper Resource Shutdown or Release
CWE-416
Use After Free
CWE-476
NULL Pointer Dereference
CWE-617
Reachable Assertion
CWE-667
Improper Locking
CWE-769
DEPRECATED: Uncontrolled File Descriptor Consumption
CWE-787
Out-of-bounds Write
CWE-825
Expired Pointer Dereference
CWE-1287
Improper Validation of Specified Type of Input
{
"document": {
"category": "csaf_security_advisory",
"csaf_version": "2.0",
"distribution": {
"tlp": {
"label": "WHITE"
}
},
"lang": "nl",
"notes": [
{
"category": "legal_disclaimer",
"text": "The Netherlands Cyber Security Center (henceforth: NCSC-NL) maintains this page to enhance access to its information and security advisories. The use of this security advisory is subject to the following terms and conditions:\n\n NCSC-NL makes every reasonable effort to ensure that the content of this page is kept up to date, and that it is accurate and complete. Nevertheless, NCSC-NL cannot entirely rule out the possibility of errors, and therefore cannot give any warranty in respect of its completeness, accuracy or continuous keeping up-to-date. The information contained in this security advisory is intended solely for the purpose of providing general information to professional users. No rights can be derived from the information provided therein.\n\n NCSC-NL and the Kingdom of the Netherlands assume no legal liability or responsibility for any damage resulting from either the use or inability of use of this security advisory. This includes damage resulting from the inaccuracy of incompleteness of the information contained in the advisory.\n This security advisory is subject to Dutch law. All disputes related to or arising from the use of this advisory will be submitted to the competent court in The Hague. This choice of means also applies to the court in summary proceedings."
},
{
"category": "description",
"text": "Google heeft kwetsbaarheden verholpen in Android. Samsung heeft de voor Samsung mobile relevante kwetsbaarheden verholpen in Samsung mobile.",
"title": "Feiten"
},
{
"category": "description",
"text": "De kwetsbaarheden zijn voornamelijk gerelateerd aan onjuiste invoervalidatie, wat kan resulteren in systeemcrashes en remote denial of service-aanvallen via kwaadaardige basisstations zonder dat gebruikersinteractie vereist is. Dit vormt een risico voor de stabiliteit en integriteit van de systemen die deze technologie gebruiken. \n\nGoogle meldt informatie te hebben ontvangen dat de kwetsbaarheden met kenmerk CVE-2025-48633 en CVE-2025-48572 beperkt en gericht zijn misbruikt. Deze kwetsbaarheden bevinden zich in het Android Framework en stellen een kwaadwillende in staat zich verhoogde rechten toe te kennen en toegang te krijgen tot gevoelige gegevens. Voor zover bekend moet voor succesvol misbruik de kwaadwillende het slachtoffer misleiden een malafide app te installeren.",
"title": "Interpretaties"
},
{
"category": "description",
"text": "Google en Samsung hebben patches uitgebracht om de kwetsbaarheden te verhelpen. Zie bijgevoegde referenties voor meer informatie.",
"title": "Oplossingen"
},
{
"category": "general",
"text": "medium",
"title": "Kans"
},
{
"category": "general",
"text": "high",
"title": "Schade"
},
{
"category": "general",
"text": "Improper Input Validation",
"title": "CWE-20"
},
{
"category": "general",
"text": "Improper Neutralization of Special Elements used in an OS Command (\u0027OS Command Injection\u0027)",
"title": "CWE-78"
},
{
"category": "general",
"text": "Heap-based Buffer Overflow",
"title": "CWE-122"
},
{
"category": "general",
"text": "Out-of-bounds Read",
"title": "CWE-125"
},
{
"category": "general",
"text": "Incorrect Calculation of Buffer Size",
"title": "CWE-131"
},
{
"category": "general",
"text": "Integer Overflow or Wraparound",
"title": "CWE-190"
},
{
"category": "general",
"text": "Uncaught Exception",
"title": "CWE-248"
},
{
"category": "general",
"text": "Improper Handling of Insufficient Permissions or Privileges ",
"title": "CWE-280"
},
{
"category": "general",
"text": "Improper Authentication",
"title": "CWE-287"
},
{
"category": "general",
"text": "Improper Resource Shutdown or Release",
"title": "CWE-404"
},
{
"category": "general",
"text": "Use After Free",
"title": "CWE-416"
},
{
"category": "general",
"text": "NULL Pointer Dereference",
"title": "CWE-476"
},
{
"category": "general",
"text": "Reachable Assertion",
"title": "CWE-617"
},
{
"category": "general",
"text": "Improper Locking",
"title": "CWE-667"
},
{
"category": "general",
"text": "DEPRECATED: Uncontrolled File Descriptor Consumption",
"title": "CWE-769"
},
{
"category": "general",
"text": "Out-of-bounds Write",
"title": "CWE-787"
},
{
"category": "general",
"text": "Expired Pointer Dereference",
"title": "CWE-825"
},
{
"category": "general",
"text": "Improper Validation of Specified Type of Input",
"title": "CWE-1287"
}
],
"publisher": {
"category": "coordinator",
"contact_details": "cert@ncsc.nl",
"name": "Nationaal Cyber Security Centrum",
"namespace": "https://www.ncsc.nl/"
},
"references": [
{
"category": "external",
"summary": "Reference",
"url": "https://security.samsungmobile.com/securityUpdate.smsb?year=2025\u0026month=12"
},
{
"category": "external",
"summary": "Reference",
"url": "https://source.android.com/docs/security/bulletin/2025-12-01"
}
],
"title": "Kwetsbaarheden verholpen in Google Android en Samsung Mobile",
"tracking": {
"current_release_date": "2025-12-02T13:25:17.745981Z",
"generator": {
"date": "2025-08-04T16:30:00Z",
"engine": {
"name": "V.A.",
"version": "1.3"
}
},
"id": "NCSC-2025-0379",
"initial_release_date": "2025-12-02T13:25:17.745981Z",
"revision_history": [
{
"date": "2025-12-02T13:25:17.745981Z",
"number": "1.0.0",
"summary": "Initiele versie"
}
],
"status": "final",
"version": "1.0.0"
}
},
"product_tree": {
"branches": [
{
"branches": [
{
"branches": [
{
"category": "product_version_range",
"name": "vers:unknown/*",
"product": {
"name": "vers:unknown/*",
"product_id": "CSAFPID-1"
}
}
],
"category": "product_name",
"name": "Android"
}
],
"category": "vendor",
"name": "Google"
},
{
"branches": [
{
"branches": [
{
"category": "product_version_range",
"name": "vers:unknown/*",
"product": {
"name": "vers:unknown/*",
"product_id": "CSAFPID-2"
}
}
],
"category": "product_name",
"name": "Samsung Mobile Devices"
}
],
"category": "vendor",
"name": "Samsung"
}
]
},
"vulnerabilities": [
{
"cve": "CVE-2023-40130",
"notes": [
{
"category": "description",
"text": "A logic error in CallRedirectionProcessor.java may allow permission bypass, while Google has patched multiple CVEs in the September 25 and October 1, 2023 Android Security Bulletins.",
"title": "Summary"
}
],
"product_status": {
"known_affected": [
"CSAFPID-1",
"CSAFPID-2"
]
},
"references": [
{
"category": "self",
"summary": "CVE-2023-40130 | NCSC-NL Website",
"url": "https://vulnerabilities.ncsc.nl/csaf/v2/2023/cve-2023-40130.json"
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 7.8,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"products": [
"CSAFPID-1",
"CSAFPID-2"
]
}
],
"title": "CVE-2023-40130"
},
{
"cve": "CVE-2024-35970",
"cwe": {
"id": "CWE-667",
"name": "Improper Locking"
},
"notes": [
{
"category": "other",
"text": "Improper Locking",
"title": "CWE-667"
},
{
"category": "description",
"text": "Recent updates to the SUSE Linux Enterprise 15 SP6 and Ubuntu Linux Kernels addressed multiple security vulnerabilities, including memory leaks, buffer overflows, and potential remote code execution risks.",
"title": "Summary"
}
],
"product_status": {
"known_affected": [
"CSAFPID-1",
"CSAFPID-2"
]
},
"references": [
{
"category": "self",
"summary": "CVE-2024-35970 | NCSC-NL Website",
"url": "https://vulnerabilities.ncsc.nl/csaf/v2/2024/cve-2024-35970.json"
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 6.3,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L",
"version": "3.1"
},
"products": [
"CSAFPID-1",
"CSAFPID-2"
]
}
],
"title": "CVE-2024-35970"
},
{
"cve": "CVE-2025-3012",
"notes": [
{
"category": "description",
"text": "The dpc modem is susceptible to a null pointer dereference vulnerability that can lead to a remote denial of service, potentially causing a system crash without requiring additional execution privileges.",
"title": "Summary"
},
{
"category": "general",
"text": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"title": "CVSSV4"
}
],
"product_status": {
"known_affected": [
"CSAFPID-1",
"CSAFPID-2"
]
},
"references": [
{
"category": "self",
"summary": "CVE-2025-3012 | NCSC-NL Website",
"url": "https://vulnerabilities.ncsc.nl/csaf/v2/2025/cve-2025-3012.json"
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 7.5,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
},
"products": [
"CSAFPID-1",
"CSAFPID-2"
]
}
],
"title": "CVE-2025-3012"
},
{
"cve": "CVE-2025-6349",
"cwe": {
"id": "CWE-416",
"name": "Use After Free"
},
"notes": [
{
"category": "other",
"text": "Use After Free",
"title": "CWE-416"
},
{
"category": "description",
"text": "A Use After Free vulnerability in the Arm Ltd Valhall GPU Kernel Driver affects versions r53p0 to r54p1, allowing local non-privileged user processes to access freed memory improperly.",
"title": "Summary"
},
{
"category": "general",
"text": "CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N",
"title": "CVSSV4"
}
],
"product_status": {
"known_affected": [
"CSAFPID-1",
"CSAFPID-2"
]
},
"references": [
{
"category": "self",
"summary": "CVE-2025-6349 | NCSC-NL Website",
"url": "https://vulnerabilities.ncsc.nl/csaf/v2/2025/cve-2025-6349.json"
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 5.1,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N",
"version": "3.1"
},
"products": [
"CSAFPID-1",
"CSAFPID-2"
]
}
],
"title": "CVE-2025-6349"
},
{
"cve": "CVE-2025-6573",
"cwe": {
"id": "CWE-280",
"name": "Improper Handling of Insufficient Permissions or Privileges "
},
"notes": [
{
"category": "other",
"text": "Improper Handling of Insufficient Permissions or Privileges ",
"title": "CWE-280"
},
{
"category": "description",
"text": "Kernel software operating in untrusted environments may leak sensitive information from trusted execution environments, posing significant security risks.",
"title": "Summary"
},
{
"category": "general",
"text": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N",
"title": "CVSSV4"
}
],
"product_status": {
"known_affected": [
"CSAFPID-1",
"CSAFPID-2"
]
},
"references": [
{
"category": "self",
"summary": "CVE-2025-6573 | NCSC-NL Website",
"url": "https://vulnerabilities.ncsc.nl/csaf/v2/2025/cve-2025-6573.json"
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 9.8,
"baseSeverity": "CRITICAL",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"products": [
"CSAFPID-1",
"CSAFPID-2"
]
}
],
"title": "CVE-2025-6573"
},
{
"cve": "CVE-2025-8045",
"cwe": {
"id": "CWE-416",
"name": "Use After Free"
},
"notes": [
{
"category": "other",
"text": "Use After Free",
"title": "CWE-416"
},
{
"category": "description",
"text": "A Use After Free vulnerability in the Arm Ltd Valhall GPU Kernel Driver affects versions r53p0 to r54p1, allowing local non-privileged user processes to access freed memory improperly.",
"title": "Summary"
},
{
"category": "general",
"text": "CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N",
"title": "CVSSV4"
}
],
"product_status": {
"known_affected": [
"CSAFPID-1",
"CSAFPID-2"
]
},
"references": [
{
"category": "self",
"summary": "CVE-2025-8045 | NCSC-NL Website",
"url": "https://vulnerabilities.ncsc.nl/csaf/v2/2025/cve-2025-8045.json"
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 4.0,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N",
"version": "3.1"
},
"products": [
"CSAFPID-1",
"CSAFPID-2"
]
}
],
"title": "CVE-2025-8045"
},
{
"cve": "CVE-2025-11131",
"notes": [
{
"category": "description",
"text": "The nr modem is susceptible to a remote denial of service due to inadequate input validation, potentially leading to a system crash without requiring additional execution privileges.",
"title": "Summary"
},
{
"category": "general",
"text": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"title": "CVSSV4"
}
],
"product_status": {
"known_affected": [
"CSAFPID-1",
"CSAFPID-2"
]
},
"references": [
{
"category": "self",
"summary": "CVE-2025-11131 | NCSC-NL Website",
"url": "https://vulnerabilities.ncsc.nl/csaf/v2/2025/cve-2025-11131.json"
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 7.5,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
},
"products": [
"CSAFPID-1",
"CSAFPID-2"
]
}
],
"title": "CVE-2025-11131"
},
{
"cve": "CVE-2025-11132",
"notes": [
{
"category": "description",
"text": "The nr modem is susceptible to a remote denial of service due to inadequate input validation, potentially leading to a system crash without requiring additional execution privileges.",
"title": "Summary"
},
{
"category": "general",
"text": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"title": "CVSSV4"
}
],
"product_status": {
"known_affected": [
"CSAFPID-1",
"CSAFPID-2"
]
},
"references": [
{
"category": "self",
"summary": "CVE-2025-11132 | NCSC-NL Website",
"url": "https://vulnerabilities.ncsc.nl/csaf/v2/2025/cve-2025-11132.json"
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 7.5,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
},
"products": [
"CSAFPID-1",
"CSAFPID-2"
]
}
],
"title": "CVE-2025-11132"
},
{
"cve": "CVE-2025-11133",
"notes": [
{
"category": "description",
"text": "The nr modem is susceptible to a remote denial of service due to inadequate input validation, potentially leading to a system crash without requiring additional execution privileges.",
"title": "Summary"
},
{
"category": "general",
"text": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"title": "CVSSV4"
}
],
"product_status": {
"known_affected": [
"CSAFPID-1",
"CSAFPID-2"
]
},
"references": [
{
"category": "self",
"summary": "CVE-2025-11133 | NCSC-NL Website",
"url": "https://vulnerabilities.ncsc.nl/csaf/v2/2025/cve-2025-11133.json"
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 7.5,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
},
"products": [
"CSAFPID-1",
"CSAFPID-2"
]
}
],
"title": "CVE-2025-11133"
},
{
"cve": "CVE-2025-20725",
"cwe": {
"id": "CWE-787",
"name": "Out-of-bounds Write"
},
"notes": [
{
"category": "other",
"text": "Out-of-bounds Write",
"title": "CWE-787"
},
{
"category": "description",
"text": "The ims service has a vulnerability allowing potential out of bounds write, enabling remote privilege escalation via malicious base stations, with a patch available under ID MOLY01671924 and identified as MSV-4620.",
"title": "Summary"
}
],
"product_status": {
"known_affected": [
"CSAFPID-1",
"CSAFPID-2"
]
},
"references": [
{
"category": "self",
"summary": "CVE-2025-20725 | NCSC-NL Website",
"url": "https://vulnerabilities.ncsc.nl/csaf/v2/2025/cve-2025-20725.json"
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 7.5,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"products": [
"CSAFPID-1",
"CSAFPID-2"
]
}
],
"title": "CVE-2025-20725"
},
{
"cve": "CVE-2025-20726",
"cwe": {
"id": "CWE-122",
"name": "Heap-based Buffer Overflow"
},
"notes": [
{
"category": "other",
"text": "Heap-based Buffer Overflow",
"title": "CWE-122"
},
{
"category": "other",
"text": "Out-of-bounds Write",
"title": "CWE-787"
},
{
"category": "description",
"text": "The document outlines a vulnerability in Modem that could allow remote privilege escalation through an out of bounds write due to improper bounds checking when connecting to a malicious base station.",
"title": "Summary"
}
],
"product_status": {
"known_affected": [
"CSAFPID-1",
"CSAFPID-2"
]
},
"references": [
{
"category": "self",
"summary": "CVE-2025-20726 | NCSC-NL Website",
"url": "https://vulnerabilities.ncsc.nl/csaf/v2/2025/cve-2025-20726.json"
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 7.5,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"products": [
"CSAFPID-1",
"CSAFPID-2"
]
}
],
"title": "CVE-2025-20726"
},
{
"cve": "CVE-2025-20727",
"cwe": {
"id": "CWE-787",
"name": "Out-of-bounds Write"
},
"notes": [
{
"category": "other",
"text": "Out-of-bounds Write",
"title": "CWE-787"
},
{
"category": "description",
"text": "The document outlines a heap buffer overflow vulnerability in Modem that enables remote privilege escalation when user equipment connects to a malicious base station without requiring user interaction.",
"title": "Summary"
}
],
"product_status": {
"known_affected": [
"CSAFPID-1",
"CSAFPID-2"
]
},
"references": [
{
"category": "self",
"summary": "CVE-2025-20727 | NCSC-NL Website",
"url": "https://vulnerabilities.ncsc.nl/csaf/v2/2025/cve-2025-20727.json"
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 7.5,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"products": [
"CSAFPID-1",
"CSAFPID-2"
]
}
],
"title": "CVE-2025-20727"
},
{
"cve": "CVE-2025-20730",
"cwe": {
"id": "CWE-287",
"name": "Improper Authentication"
},
"notes": [
{
"category": "other",
"text": "Improper Authentication",
"title": "CWE-287"
},
{
"category": "description",
"text": "The document outlines a privilege escalation vulnerability in a preloader due to an insecure default value, allowing local exploitation by a malicious actor with System privilege without user interaction.",
"title": "Summary"
}
],
"product_status": {
"known_affected": [
"CSAFPID-1",
"CSAFPID-2"
]
},
"references": [
{
"category": "self",
"summary": "CVE-2025-20730 | NCSC-NL Website",
"url": "https://vulnerabilities.ncsc.nl/csaf/v2/2025/cve-2025-20730.json"
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 6.7,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"products": [
"CSAFPID-1",
"CSAFPID-2"
]
}
],
"title": "CVE-2025-20730"
},
{
"cve": "CVE-2025-20750",
"cwe": {
"id": "CWE-476",
"name": "NULL Pointer Dereference"
},
"notes": [
{
"category": "other",
"text": "NULL Pointer Dereference",
"title": "CWE-476"
},
{
"category": "description",
"text": "A vulnerability in Modem can lead to system crashes due to improper input validation, enabling remote denial of service via a rogue base station, with a patch available (Patch ID: MOLY01661199, Issue ID: MSV-4296).",
"title": "Summary"
}
],
"product_status": {
"known_affected": [
"CSAFPID-1",
"CSAFPID-2"
]
},
"references": [
{
"category": "self",
"summary": "CVE-2025-20750 | NCSC-NL Website",
"url": "https://vulnerabilities.ncsc.nl/csaf/v2/2025/cve-2025-20750.json"
}
],
"title": "CVE-2025-20750"
},
{
"cve": "CVE-2025-20751",
"cwe": {
"id": "CWE-787",
"name": "Out-of-bounds Write"
},
"notes": [
{
"category": "other",
"text": "Out-of-bounds Write",
"title": "CWE-787"
},
{
"category": "description",
"text": "A vulnerability in Modem can lead to a system crash due to a missing bounds check, enabling remote denial of service via a rogue base station without user interaction; a patch is available.",
"title": "Summary"
}
],
"product_status": {
"known_affected": [
"CSAFPID-1",
"CSAFPID-2"
]
},
"references": [
{
"category": "self",
"summary": "CVE-2025-20751 | NCSC-NL Website",
"url": "https://vulnerabilities.ncsc.nl/csaf/v2/2025/cve-2025-20751.json"
}
],
"title": "CVE-2025-20751"
},
{
"cve": "CVE-2025-20752",
"cwe": {
"id": "CWE-617",
"name": "Reachable Assertion"
},
"notes": [
{
"category": "other",
"text": "Reachable Assertion",
"title": "CWE-617"
},
{
"category": "description",
"text": "A missing bounds check in Modem could lead to a remote denial of service if user equipment connects to a rogue base station, with a patch (MOLY01270690) available for this vulnerability (MSV-4301).",
"title": "Summary"
}
],
"product_status": {
"known_affected": [
"CSAFPID-1",
"CSAFPID-2"
]
},
"references": [
{
"category": "self",
"summary": "CVE-2025-20752 | NCSC-NL Website",
"url": "https://vulnerabilities.ncsc.nl/csaf/v2/2025/cve-2025-20752.json"
}
],
"title": "CVE-2025-20752"
},
{
"cve": "CVE-2025-20753",
"cwe": {
"id": "CWE-248",
"name": "Uncaught Exception"
},
"notes": [
{
"category": "other",
"text": "Uncaught Exception",
"title": "CWE-248"
},
{
"category": "description",
"text": "A vulnerability in Modem could lead to a remote denial of service via an uncaught exception from a rogue base station, with a patch (MOLY01689252) available to address this issue.",
"title": "Summary"
}
],
"product_status": {
"known_affected": [
"CSAFPID-1",
"CSAFPID-2"
]
},
"references": [
{
"category": "self",
"summary": "CVE-2025-20753 | NCSC-NL Website",
"url": "https://vulnerabilities.ncsc.nl/csaf/v2/2025/cve-2025-20753.json"
}
],
"title": "CVE-2025-20753"
},
{
"cve": "CVE-2025-20754",
"cwe": {
"id": "CWE-248",
"name": "Uncaught Exception"
},
"notes": [
{
"category": "other",
"text": "Uncaught Exception",
"title": "CWE-248"
},
{
"category": "description",
"text": "A vulnerability in Modem can lead to a system crash due to an incorrect bounds check, enabling remote denial of service via a rogue base station, with a patch available (Patch ID: MOLY01689251, Issue ID: MSV-4840).",
"title": "Summary"
}
],
"product_status": {
"known_affected": [
"CSAFPID-1",
"CSAFPID-2"
]
},
"references": [
{
"category": "self",
"summary": "CVE-2025-20754 | NCSC-NL Website",
"url": "https://vulnerabilities.ncsc.nl/csaf/v2/2025/cve-2025-20754.json"
}
],
"title": "CVE-2025-20754"
},
{
"cve": "CVE-2025-20755",
"cwe": {
"id": "CWE-476",
"name": "NULL Pointer Dereference"
},
"notes": [
{
"category": "other",
"text": "NULL Pointer Dereference",
"title": "CWE-476"
},
{
"category": "description",
"text": "A vulnerability in Modem can lead to application crashes due to improper input validation, enabling remote denial of service via a rogue base station, with a patch available (Patch ID: MOLY00628396, Issue ID: MSV-4775).",
"title": "Summary"
}
],
"product_status": {
"known_affected": [
"CSAFPID-1",
"CSAFPID-2"
]
},
"references": [
{
"category": "self",
"summary": "CVE-2025-20755 | NCSC-NL Website",
"url": "https://vulnerabilities.ncsc.nl/csaf/v2/2025/cve-2025-20755.json"
}
],
"title": "CVE-2025-20755"
},
{
"cve": "CVE-2025-20756",
"cwe": {
"id": "CWE-1287",
"name": "Improper Validation of Specified Type of Input"
},
"notes": [
{
"category": "other",
"text": "Improper Validation of Specified Type of Input",
"title": "CWE-1287"
},
{
"category": "description",
"text": "A logic error in Modem can lead to system crashes and remote denial of service via a rogue base station, with a patch (MOLY01673749) available for this vulnerability (MSV-4643).",
"title": "Summary"
}
],
"product_status": {
"known_affected": [
"CSAFPID-1",
"CSAFPID-2"
]
},
"references": [
{
"category": "self",
"summary": "CVE-2025-20756 | NCSC-NL Website",
"url": "https://vulnerabilities.ncsc.nl/csaf/v2/2025/cve-2025-20756.json"
}
],
"title": "CVE-2025-20756"
},
{
"cve": "CVE-2025-20757",
"cwe": {
"id": "CWE-617",
"name": "Reachable Assertion"
},
"notes": [
{
"category": "other",
"text": "Reachable Assertion",
"title": "CWE-617"
},
{
"category": "description",
"text": "A vulnerability in Modem can lead to a system crash due to improper input validation, enabling remote denial of service via a rogue base station, with a patch available (Patch ID: MOLY01673751, Issue ID: MSV-4644).",
"title": "Summary"
}
],
"product_status": {
"known_affected": [
"CSAFPID-1",
"CSAFPID-2"
]
},
"references": [
{
"category": "self",
"summary": "CVE-2025-20757 | NCSC-NL Website",
"url": "https://vulnerabilities.ncsc.nl/csaf/v2/2025/cve-2025-20757.json"
}
],
"title": "CVE-2025-20757"
},
{
"cve": "CVE-2025-20758",
"cwe": {
"id": "CWE-248",
"name": "Uncaught Exception"
},
"notes": [
{
"category": "other",
"text": "Uncaught Exception",
"title": "CWE-248"
},
{
"category": "description",
"text": "A vulnerability in Modem could lead to a remote denial of service via an uncaught exception from a rogue base station, with a patch (MOLY01673755) available for resolution.",
"title": "Summary"
}
],
"product_status": {
"known_affected": [
"CSAFPID-1",
"CSAFPID-2"
]
},
"references": [
{
"category": "self",
"summary": "CVE-2025-20758 | NCSC-NL Website",
"url": "https://vulnerabilities.ncsc.nl/csaf/v2/2025/cve-2025-20758.json"
}
],
"title": "CVE-2025-20758"
},
{
"cve": "CVE-2025-20759",
"cwe": {
"id": "CWE-125",
"name": "Out-of-bounds Read"
},
"notes": [
{
"category": "other",
"text": "Out-of-bounds Read",
"title": "CWE-125"
},
{
"category": "description",
"text": "A vulnerability in Modem, identified by Patch ID: MOLY01673760 and Issue ID: MSV-4650, allows for potential out of bounds read, enabling remote denial of service via a rogue base station without user interaction.",
"title": "Summary"
}
],
"product_status": {
"known_affected": [
"CSAFPID-1",
"CSAFPID-2"
]
},
"references": [
{
"category": "self",
"summary": "CVE-2025-20759 | NCSC-NL Website",
"url": "https://vulnerabilities.ncsc.nl/csaf/v2/2025/cve-2025-20759.json"
}
],
"title": "CVE-2025-20759"
},
{
"cve": "CVE-2025-20790",
"cwe": {
"id": "CWE-476",
"name": "NULL Pointer Dereference"
},
"notes": [
{
"category": "other",
"text": "NULL Pointer Dereference",
"title": "CWE-476"
},
{
"category": "description",
"text": "A vulnerability in Modem can lead to system crashes due to improper input validation, enabling remote denial of service via a rogue base station, with a patch available (Patch ID: MOLY01677581, Issue ID: MSV-4701).",
"title": "Summary"
}
],
"product_status": {
"known_affected": [
"CSAFPID-1",
"CSAFPID-2"
]
},
"references": [
{
"category": "self",
"summary": "CVE-2025-20790 | NCSC-NL Website",
"url": "https://vulnerabilities.ncsc.nl/csaf/v2/2025/cve-2025-20790.json"
}
],
"title": "CVE-2025-20790"
},
{
"cve": "CVE-2025-20791",
"cwe": {
"id": "CWE-617",
"name": "Reachable Assertion"
},
"notes": [
{
"category": "other",
"text": "Reachable Assertion",
"title": "CWE-617"
},
{
"category": "description",
"text": "A vulnerability in Modem\u0027s error handling could enable remote denial of service via a rogue base station, with a patch (MOLY01661189) available for resolution.",
"title": "Summary"
}
],
"product_status": {
"known_affected": [
"CSAFPID-1",
"CSAFPID-2"
]
},
"references": [
{
"category": "self",
"summary": "CVE-2025-20791 | NCSC-NL Website",
"url": "https://vulnerabilities.ncsc.nl/csaf/v2/2025/cve-2025-20791.json"
}
],
"title": "CVE-2025-20791"
},
{
"cve": "CVE-2025-20792",
"cwe": {
"id": "CWE-617",
"name": "Reachable Assertion"
},
"notes": [
{
"category": "other",
"text": "Reachable Assertion",
"title": "CWE-617"
},
{
"category": "description",
"text": "A vulnerability in Modem can lead to system crashes due to improper input validation, enabling remote denial of service via a rogue base station, with a patch available (Patch ID: MOLY01717526; Issue ID: MSV-5591).",
"title": "Summary"
}
],
"product_status": {
"known_affected": [
"CSAFPID-1",
"CSAFPID-2"
]
},
"references": [
{
"category": "self",
"summary": "CVE-2025-20792 | NCSC-NL Website",
"url": "https://vulnerabilities.ncsc.nl/csaf/v2/2025/cve-2025-20792.json"
}
],
"title": "CVE-2025-20792"
},
{
"cve": "CVE-2025-21072",
"notes": [
{
"category": "description",
"text": "An out-of-bounds write vulnerability in the fingerprint trustlet\u0027s metadata decoding prior to the SMR Dec-2025 Release 1 allows local privileged attackers to manipulate memory outside allocated bounds.",
"title": "Summary"
}
],
"product_status": {
"known_affected": [
"CSAFPID-1",
"CSAFPID-2"
]
},
"references": [
{
"category": "self",
"summary": "CVE-2025-21072 | NCSC-NL Website",
"url": "https://vulnerabilities.ncsc.nl/csaf/v2/2025/cve-2025-21072.json"
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 5.7,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.1/AV:L/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:N",
"version": "3.1"
},
"products": [
"CSAFPID-1",
"CSAFPID-2"
]
}
],
"title": "CVE-2025-21072"
},
{
"cve": "CVE-2025-21080",
"notes": [
{
"category": "description",
"text": "The Dynamic Lockscreen in Android prior to the SMR Dec-2025 Release 1 has a vulnerability due to improper export of application components, allowing local attackers to access files improperly.",
"title": "Summary"
}
],
"product_status": {
"known_affected": [
"CSAFPID-1",
"CSAFPID-2"
]
},
"references": [
{
"category": "self",
"summary": "CVE-2025-21080 | NCSC-NL Website",
"url": "https://vulnerabilities.ncsc.nl/csaf/v2/2025/cve-2025-21080.json"
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 6.2,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N",
"version": "3.1"
},
"products": [
"CSAFPID-1",
"CSAFPID-2"
]
}
],
"title": "CVE-2025-21080"
},
{
"cve": "CVE-2025-22420",
"product_status": {
"known_affected": [
"CSAFPID-1",
"CSAFPID-2"
]
},
"references": [
{
"category": "self",
"summary": "CVE-2025-22420 | NCSC-NL Website",
"url": "https://vulnerabilities.ncsc.nl/csaf/v2/2025/cve-2025-22420.json"
}
],
"title": "CVE-2025-22420"
},
{
"cve": "CVE-2025-22432",
"product_status": {
"known_affected": [
"CSAFPID-1",
"CSAFPID-2"
]
},
"references": [
{
"category": "self",
"summary": "CVE-2025-22432 | NCSC-NL Website",
"url": "https://vulnerabilities.ncsc.nl/csaf/v2/2025/cve-2025-22432.json"
}
],
"title": "CVE-2025-22432"
},
{
"cve": "CVE-2025-25177",
"cwe": {
"id": "CWE-416",
"name": "Use After Free"
},
"notes": [
{
"category": "other",
"text": "Use After Free",
"title": "CWE-416"
},
{
"category": "description",
"text": "Software running with non-privileged user permissions can improperly execute GPU system calls, resulting in use-after-free kernel exceptions.",
"title": "Summary"
},
{
"category": "general",
"text": "CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N",
"title": "CVSSV4"
}
],
"product_status": {
"known_affected": [
"CSAFPID-1",
"CSAFPID-2"
]
},
"references": [
{
"category": "self",
"summary": "CVE-2025-25177 | NCSC-NL Website",
"url": "https://vulnerabilities.ncsc.nl/csaf/v2/2025/cve-2025-25177.json"
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 5.1,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N",
"version": "3.1"
},
"products": [
"CSAFPID-1",
"CSAFPID-2"
]
}
],
"title": "CVE-2025-25177"
},
{
"cve": "CVE-2025-27053",
"cwe": {
"id": "CWE-131",
"name": "Incorrect Calculation of Buffer Size"
},
"notes": [
{
"category": "other",
"text": "Incorrect Calculation of Buffer Size",
"title": "CWE-131"
},
{
"category": "description",
"text": "Memory corruption issues have been identified in the PlayReady APP during the processing of TA commands, potentially leading to security vulnerabilities.",
"title": "Summary"
},
{
"category": "general",
"text": "CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N",
"title": "CVSSV4"
}
],
"product_status": {
"known_affected": [
"CSAFPID-1",
"CSAFPID-2"
]
},
"references": [
{
"category": "self",
"summary": "CVE-2025-27053 | NCSC-NL Website",
"url": "https://vulnerabilities.ncsc.nl/csaf/v2/2025/cve-2025-27053.json"
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 7.8,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"products": [
"CSAFPID-1",
"CSAFPID-2"
]
}
],
"title": "CVE-2025-27053"
},
{
"cve": "CVE-2025-27054",
"cwe": {
"id": "CWE-787",
"name": "Out-of-bounds Write"
},
"notes": [
{
"category": "other",
"text": "Out-of-bounds Write",
"title": "CWE-787"
},
{
"category": "description",
"text": "Memory corruption can occur during system reboot when a malformed license file is processed, potentially leading to system instability.",
"title": "Summary"
},
{
"category": "general",
"text": "CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N",
"title": "CVSSV4"
}
],
"product_status": {
"known_affected": [
"CSAFPID-1",
"CSAFPID-2"
]
},
"references": [
{
"category": "self",
"summary": "CVE-2025-27054 | NCSC-NL Website",
"url": "https://vulnerabilities.ncsc.nl/csaf/v2/2025/cve-2025-27054.json"
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 7.8,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"products": [
"CSAFPID-1",
"CSAFPID-2"
]
}
],
"title": "CVE-2025-27054"
},
{
"cve": "CVE-2025-27070",
"cwe": {
"id": "CWE-787",
"name": "Out-of-bounds Write"
},
"notes": [
{
"category": "other",
"text": "Out-of-bounds Write",
"title": "CWE-787"
},
{
"category": "description",
"text": "The document addresses memory corruption issues that arise during the execution of encryption and decryption commands.",
"title": "Summary"
}
],
"product_status": {
"known_affected": [
"CSAFPID-1",
"CSAFPID-2"
]
},
"references": [
{
"category": "self",
"summary": "CVE-2025-27070 | NCSC-NL Website",
"url": "https://vulnerabilities.ncsc.nl/csaf/v2/2025/cve-2025-27070.json"
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 7.8,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"products": [
"CSAFPID-1",
"CSAFPID-2"
]
}
],
"title": "CVE-2025-27070"
},
{
"cve": "CVE-2025-27074",
"cwe": {
"id": "CWE-131",
"name": "Incorrect Calculation of Buffer Size"
},
"notes": [
{
"category": "other",
"text": "Incorrect Calculation of Buffer Size",
"title": "CWE-131"
},
{
"category": "description",
"text": "Memory corruption has been identified during the processing of a GP command response, potentially affecting system stability and security.",
"title": "Summary"
}
],
"product_status": {
"known_affected": [
"CSAFPID-1",
"CSAFPID-2"
]
},
"references": [
{
"category": "self",
"summary": "CVE-2025-27074 | NCSC-NL Website",
"url": "https://vulnerabilities.ncsc.nl/csaf/v2/2025/cve-2025-27074.json"
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 8.8,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H",
"version": "3.1"
},
"products": [
"CSAFPID-1",
"CSAFPID-2"
]
}
],
"title": "CVE-2025-27074"
},
{
"cve": "CVE-2025-31717",
"notes": [
{
"category": "description",
"text": "The modem is susceptible to a remote denial of service due to inadequate input validation, potentially leading to a system crash without requiring additional execution privileges.",
"title": "Summary"
},
{
"category": "general",
"text": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"title": "CVSSV4"
}
],
"product_status": {
"known_affected": [
"CSAFPID-1",
"CSAFPID-2"
]
},
"references": [
{
"category": "self",
"summary": "CVE-2025-31717 | NCSC-NL Website",
"url": "https://vulnerabilities.ncsc.nl/csaf/v2/2025/cve-2025-31717.json"
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 7.5,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
},
"products": [
"CSAFPID-1",
"CSAFPID-2"
]
}
],
"title": "CVE-2025-31717"
},
{
"cve": "CVE-2025-31718",
"notes": [
{
"category": "description",
"text": "The document highlights a vulnerability in a modem that may lead to a system crash due to insufficient input validation, enabling remote privilege escalation without additional execution privileges.",
"title": "Summary"
},
{
"category": "general",
"text": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N",
"title": "CVSSV4"
}
],
"product_status": {
"known_affected": [
"CSAFPID-1",
"CSAFPID-2"
]
},
"references": [
{
"category": "self",
"summary": "CVE-2025-31718 | NCSC-NL Website",
"url": "https://vulnerabilities.ncsc.nl/csaf/v2/2025/cve-2025-31718.json"
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 7.5,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
},
"products": [
"CSAFPID-1",
"CSAFPID-2"
]
}
],
"title": "CVE-2025-31718"
},
{
"cve": "CVE-2025-32319",
"product_status": {
"known_affected": [
"CSAFPID-1",
"CSAFPID-2"
]
},
"references": [
{
"category": "self",
"summary": "CVE-2025-32319 | NCSC-NL Website",
"url": "https://vulnerabilities.ncsc.nl/csaf/v2/2025/cve-2025-32319.json"
}
],
"title": "CVE-2025-32319"
},
{
"cve": "CVE-2025-32328",
"product_status": {
"known_affected": [
"CSAFPID-1",
"CSAFPID-2"
]
},
"references": [
{
"category": "self",
"summary": "CVE-2025-32328 | NCSC-NL Website",
"url": "https://vulnerabilities.ncsc.nl/csaf/v2/2025/cve-2025-32328.json"
}
],
"title": "CVE-2025-32328"
},
{
"cve": "CVE-2025-32329",
"product_status": {
"known_affected": [
"CSAFPID-1",
"CSAFPID-2"
]
},
"references": [
{
"category": "self",
"summary": "CVE-2025-32329 | NCSC-NL Website",
"url": "https://vulnerabilities.ncsc.nl/csaf/v2/2025/cve-2025-32329.json"
}
],
"title": "CVE-2025-32329"
},
{
"cve": "CVE-2025-38236",
"notes": [
{
"category": "description",
"text": "SUSE Linux Enterprise 15 SP6 and SP7 kernels were updated to address multiple security vulnerabilities, particularly in memory management, network protocols, and device handling, including a critical use-after-free issue in the af_unix implementation.",
"title": "Summary"
},
{
"category": "general",
"text": "CVSS:4.0/AV:A/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N",
"title": "CVSSV4"
}
],
"product_status": {
"known_affected": [
"CSAFPID-1",
"CSAFPID-2"
]
},
"references": [
{
"category": "self",
"summary": "CVE-2025-38236 | NCSC-NL Website",
"url": "https://vulnerabilities.ncsc.nl/csaf/v2/2025/cve-2025-38236.json"
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 7.8,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"products": [
"CSAFPID-1",
"CSAFPID-2"
]
}
],
"title": "CVE-2025-38236"
},
{
"cve": "CVE-2025-38349",
"cwe": {
"id": "CWE-416",
"name": "Use After Free"
},
"notes": [
{
"category": "other",
"text": "Use After Free",
"title": "CWE-416"
},
{
"category": "description",
"text": "Recent updates to SUSE Linux Enterprise kernels and Chrome addressed multiple security vulnerabilities, particularly in memory management, network protocols, and device handling, including use-after-free issues in the Linux kernel and Chrome\u0027s epoll system.",
"title": "Summary"
},
{
"category": "general",
"text": "CVSS:4.0/AV:A/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N",
"title": "CVSSV4"
}
],
"product_status": {
"known_affected": [
"CSAFPID-1",
"CSAFPID-2"
]
},
"references": [
{
"category": "self",
"summary": "CVE-2025-38349 | NCSC-NL Website",
"url": "https://vulnerabilities.ncsc.nl/csaf/v2/2025/cve-2025-38349.json"
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 8.4,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H/E:U",
"version": "3.1"
},
"products": [
"CSAFPID-1",
"CSAFPID-2"
]
}
],
"title": "CVE-2025-38349"
},
{
"cve": "CVE-2025-38500",
"cwe": {
"id": "CWE-825",
"name": "Expired Pointer Dereference"
},
"notes": [
{
"category": "other",
"text": "Expired Pointer Dereference",
"title": "CWE-825"
},
{
"category": "other",
"text": "Use After Free",
"title": "CWE-416"
},
{
"category": "description",
"text": "SUSE Linux Enterprise kernel updates addressed multiple security vulnerabilities, particularly in the xfrm interface and TLS data handling, resolving issues such as buffer overflows, memory leaks, and use-after-free errors.",
"title": "Summary"
}
],
"product_status": {
"known_affected": [
"CSAFPID-1",
"CSAFPID-2"
]
},
"references": [
{
"category": "self",
"summary": "CVE-2025-38500 | NCSC-NL Website",
"url": "https://vulnerabilities.ncsc.nl/csaf/v2/2025/cve-2025-38500.json"
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 7.8,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"products": [
"CSAFPID-1",
"CSAFPID-2"
]
}
],
"title": "CVE-2025-38500"
},
{
"cve": "CVE-2025-46711",
"cwe": {
"id": "CWE-476",
"name": "NULL Pointer Dereference"
},
"notes": [
{
"category": "other",
"text": "NULL Pointer Dereference",
"title": "CWE-476"
},
{
"category": "description",
"text": "Software running with non-privileged user permissions may improperly execute GPU system calls, resulting in NULL pointer dereference kernel exceptions.",
"title": "Summary"
},
{
"category": "general",
"text": "CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"title": "CVSSV4"
}
],
"product_status": {
"known_affected": [
"CSAFPID-1",
"CSAFPID-2"
]
},
"references": [
{
"category": "self",
"summary": "CVE-2025-46711 | NCSC-NL Website",
"url": "https://vulnerabilities.ncsc.nl/csaf/v2/2025/cve-2025-46711.json"
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 5.5,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
},
"products": [
"CSAFPID-1",
"CSAFPID-2"
]
}
],
"title": "CVE-2025-46711"
},
{
"cve": "CVE-2025-47319",
"product_status": {
"known_affected": [
"CSAFPID-1",
"CSAFPID-2"
]
},
"references": [
{
"category": "self",
"summary": "CVE-2025-47319 | NCSC-NL Website",
"url": "https://vulnerabilities.ncsc.nl/csaf/v2/2025/cve-2025-47319.json"
}
],
"title": "CVE-2025-47319"
},
{
"cve": "CVE-2025-47323",
"product_status": {
"known_affected": [
"CSAFPID-1",
"CSAFPID-2"
]
},
"references": [
{
"category": "self",
"summary": "CVE-2025-47323 | NCSC-NL Website",
"url": "https://vulnerabilities.ncsc.nl/csaf/v2/2025/cve-2025-47323.json"
}
],
"title": "CVE-2025-47323"
},
{
"cve": "CVE-2025-47351",
"cwe": {
"id": "CWE-190",
"name": "Integer Overflow or Wraparound"
},
"notes": [
{
"category": "other",
"text": "Integer Overflow or Wraparound",
"title": "CWE-190"
},
{
"category": "description",
"text": "Memory corruption issues have been identified during the processing of user buffers, potentially affecting system stability and security.",
"title": "Summary"
},
{
"category": "general",
"text": "CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N",
"title": "CVSSV4"
}
],
"product_status": {
"known_affected": [
"CSAFPID-1",
"CSAFPID-2"
]
},
"references": [
{
"category": "self",
"summary": "CVE-2025-47351 | NCSC-NL Website",
"url": "https://vulnerabilities.ncsc.nl/csaf/v2/2025/cve-2025-47351.json"
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 7.8,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"products": [
"CSAFPID-1",
"CSAFPID-2"
]
}
],
"title": "CVE-2025-47351"
},
{
"cve": "CVE-2025-47354",
"cwe": {
"id": "CWE-416",
"name": "Use After Free"
},
"notes": [
{
"category": "other",
"text": "Use After Free",
"title": "CWE-416"
},
{
"category": "description",
"text": "Memory corruption issues have been identified during buffer allocation in the DSP service, potentially leading to security vulnerabilities.",
"title": "Summary"
},
{
"category": "general",
"text": "CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N",
"title": "CVSSV4"
}
],
"product_status": {
"known_affected": [
"CSAFPID-1",
"CSAFPID-2"
]
},
"references": [
{
"category": "self",
"summary": "CVE-2025-47354 | NCSC-NL Website",
"url": "https://vulnerabilities.ncsc.nl/csaf/v2/2025/cve-2025-47354.json"
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 7.8,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"products": [
"CSAFPID-1",
"CSAFPID-2"
]
}
],
"title": "CVE-2025-47354"
},
{
"cve": "CVE-2025-47370",
"cwe": {
"id": "CWE-617",
"name": "Reachable Assertion"
},
"notes": [
{
"category": "other",
"text": "Reachable Assertion",
"title": "CWE-617"
},
{
"category": "description",
"text": "A transient denial of service (DOS) vulnerability arises when a remote device sends an invalid connection request during a Bluetooth low energy (LE) scan, potentially disrupting connectivity.",
"title": "Summary"
}
],
"product_status": {
"known_affected": [
"CSAFPID-1",
"CSAFPID-2"
]
},
"references": [
{
"category": "self",
"summary": "CVE-2025-47370 | NCSC-NL Website",
"url": "https://vulnerabilities.ncsc.nl/csaf/v2/2025/cve-2025-47370.json"
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 6.5,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
},
"products": [
"CSAFPID-1",
"CSAFPID-2"
]
}
],
"title": "CVE-2025-47370"
},
{
"cve": "CVE-2025-47372",
"product_status": {
"known_affected": [
"CSAFPID-1",
"CSAFPID-2"
]
},
"references": [
{
"category": "self",
"summary": "CVE-2025-47372 | NCSC-NL Website",
"url": "https://vulnerabilities.ncsc.nl/csaf/v2/2025/cve-2025-47372.json"
}
],
"title": "CVE-2025-47372"
},
{
"cve": "CVE-2025-47382",
"product_status": {
"known_affected": [
"CSAFPID-1",
"CSAFPID-2"
]
},
"references": [
{
"category": "self",
"summary": "CVE-2025-47382 | NCSC-NL Website",
"url": "https://vulnerabilities.ncsc.nl/csaf/v2/2025/cve-2025-47382.json"
}
],
"title": "CVE-2025-47382"
},
{
"cve": "CVE-2025-48525",
"product_status": {
"known_affected": [
"CSAFPID-1",
"CSAFPID-2"
]
},
"references": [
{
"category": "self",
"summary": "CVE-2025-48525 | NCSC-NL Website",
"url": "https://vulnerabilities.ncsc.nl/csaf/v2/2025/cve-2025-48525.json"
}
],
"title": "CVE-2025-48525"
},
{
"cve": "CVE-2025-48536",
"product_status": {
"known_affected": [
"CSAFPID-1",
"CSAFPID-2"
]
},
"references": [
{
"category": "self",
"summary": "CVE-2025-48536 | NCSC-NL Website",
"url": "https://vulnerabilities.ncsc.nl/csaf/v2/2025/cve-2025-48536.json"
}
],
"title": "CVE-2025-48536"
},
{
"cve": "CVE-2025-48555",
"product_status": {
"known_affected": [
"CSAFPID-1",
"CSAFPID-2"
]
},
"references": [
{
"category": "self",
"summary": "CVE-2025-48555 | NCSC-NL Website",
"url": "https://vulnerabilities.ncsc.nl/csaf/v2/2025/cve-2025-48555.json"
}
],
"title": "CVE-2025-48555"
},
{
"cve": "CVE-2025-48564",
"product_status": {
"known_affected": [
"CSAFPID-1",
"CSAFPID-2"
]
},
"references": [
{
"category": "self",
"summary": "CVE-2025-48564 | NCSC-NL Website",
"url": "https://vulnerabilities.ncsc.nl/csaf/v2/2025/cve-2025-48564.json"
}
],
"title": "CVE-2025-48564"
},
{
"cve": "CVE-2025-48565",
"product_status": {
"known_affected": [
"CSAFPID-1",
"CSAFPID-2"
]
},
"references": [
{
"category": "self",
"summary": "CVE-2025-48565 | NCSC-NL Website",
"url": "https://vulnerabilities.ncsc.nl/csaf/v2/2025/cve-2025-48565.json"
}
],
"title": "CVE-2025-48565"
},
{
"cve": "CVE-2025-48566",
"product_status": {
"known_affected": [
"CSAFPID-1",
"CSAFPID-2"
]
},
"references": [
{
"category": "self",
"summary": "CVE-2025-48566 | NCSC-NL Website",
"url": "https://vulnerabilities.ncsc.nl/csaf/v2/2025/cve-2025-48566.json"
}
],
"title": "CVE-2025-48566"
},
{
"cve": "CVE-2025-48572",
"product_status": {
"known_affected": [
"CSAFPID-1",
"CSAFPID-2"
]
},
"references": [
{
"category": "self",
"summary": "CVE-2025-48572 | NCSC-NL Website",
"url": "https://vulnerabilities.ncsc.nl/csaf/v2/2025/cve-2025-48572.json"
}
],
"title": "CVE-2025-48572"
},
{
"cve": "CVE-2025-48573",
"product_status": {
"known_affected": [
"CSAFPID-1",
"CSAFPID-2"
]
},
"references": [
{
"category": "self",
"summary": "CVE-2025-48573 | NCSC-NL Website",
"url": "https://vulnerabilities.ncsc.nl/csaf/v2/2025/cve-2025-48573.json"
}
],
"title": "CVE-2025-48573"
},
{
"cve": "CVE-2025-48575",
"product_status": {
"known_affected": [
"CSAFPID-1",
"CSAFPID-2"
]
},
"references": [
{
"category": "self",
"summary": "CVE-2025-48575 | NCSC-NL Website",
"url": "https://vulnerabilities.ncsc.nl/csaf/v2/2025/cve-2025-48575.json"
}
],
"title": "CVE-2025-48575"
},
{
"cve": "CVE-2025-48576",
"product_status": {
"known_affected": [
"CSAFPID-1",
"CSAFPID-2"
]
},
"references": [
{
"category": "self",
"summary": "CVE-2025-48576 | NCSC-NL Website",
"url": "https://vulnerabilities.ncsc.nl/csaf/v2/2025/cve-2025-48576.json"
}
],
"title": "CVE-2025-48576"
},
{
"cve": "CVE-2025-48580",
"product_status": {
"known_affected": [
"CSAFPID-1",
"CSAFPID-2"
]
},
"references": [
{
"category": "self",
"summary": "CVE-2025-48580 | NCSC-NL Website",
"url": "https://vulnerabilities.ncsc.nl/csaf/v2/2025/cve-2025-48580.json"
}
],
"title": "CVE-2025-48580"
},
{
"cve": "CVE-2025-48583",
"product_status": {
"known_affected": [
"CSAFPID-1",
"CSAFPID-2"
]
},
"references": [
{
"category": "self",
"summary": "CVE-2025-48583 | NCSC-NL Website",
"url": "https://vulnerabilities.ncsc.nl/csaf/v2/2025/cve-2025-48583.json"
}
],
"title": "CVE-2025-48583"
},
{
"cve": "CVE-2025-48584",
"product_status": {
"known_affected": [
"CSAFPID-1",
"CSAFPID-2"
]
},
"references": [
{
"category": "self",
"summary": "CVE-2025-48584 | NCSC-NL Website",
"url": "https://vulnerabilities.ncsc.nl/csaf/v2/2025/cve-2025-48584.json"
}
],
"title": "CVE-2025-48584"
},
{
"cve": "CVE-2025-48586",
"product_status": {
"known_affected": [
"CSAFPID-1",
"CSAFPID-2"
]
},
"references": [
{
"category": "self",
"summary": "CVE-2025-48586 | NCSC-NL Website",
"url": "https://vulnerabilities.ncsc.nl/csaf/v2/2025/cve-2025-48586.json"
}
],
"title": "CVE-2025-48586"
},
{
"cve": "CVE-2025-48588",
"product_status": {
"known_affected": [
"CSAFPID-1",
"CSAFPID-2"
]
},
"references": [
{
"category": "self",
"summary": "CVE-2025-48588 | NCSC-NL Website",
"url": "https://vulnerabilities.ncsc.nl/csaf/v2/2025/cve-2025-48588.json"
}
],
"title": "CVE-2025-48588"
},
{
"cve": "CVE-2025-48589",
"product_status": {
"known_affected": [
"CSAFPID-1",
"CSAFPID-2"
]
},
"references": [
{
"category": "self",
"summary": "CVE-2025-48589 | NCSC-NL Website",
"url": "https://vulnerabilities.ncsc.nl/csaf/v2/2025/cve-2025-48589.json"
}
],
"title": "CVE-2025-48589"
},
{
"cve": "CVE-2025-48590",
"product_status": {
"known_affected": [
"CSAFPID-1",
"CSAFPID-2"
]
},
"references": [
{
"category": "self",
"summary": "CVE-2025-48590 | NCSC-NL Website",
"url": "https://vulnerabilities.ncsc.nl/csaf/v2/2025/cve-2025-48590.json"
}
],
"title": "CVE-2025-48590"
},
{
"cve": "CVE-2025-48591",
"product_status": {
"known_affected": [
"CSAFPID-1",
"CSAFPID-2"
]
},
"references": [
{
"category": "self",
"summary": "CVE-2025-48591 | NCSC-NL Website",
"url": "https://vulnerabilities.ncsc.nl/csaf/v2/2025/cve-2025-48591.json"
}
],
"title": "CVE-2025-48591"
},
{
"cve": "CVE-2025-48592",
"product_status": {
"known_affected": [
"CSAFPID-1",
"CSAFPID-2"
]
},
"references": [
{
"category": "self",
"summary": "CVE-2025-48592 | NCSC-NL Website",
"url": "https://vulnerabilities.ncsc.nl/csaf/v2/2025/cve-2025-48592.json"
}
],
"title": "CVE-2025-48592"
},
{
"cve": "CVE-2025-48594",
"product_status": {
"known_affected": [
"CSAFPID-1",
"CSAFPID-2"
]
},
"references": [
{
"category": "self",
"summary": "CVE-2025-48594 | NCSC-NL Website",
"url": "https://vulnerabilities.ncsc.nl/csaf/v2/2025/cve-2025-48594.json"
}
],
"title": "CVE-2025-48594"
},
{
"cve": "CVE-2025-48596",
"product_status": {
"known_affected": [
"CSAFPID-1",
"CSAFPID-2"
]
},
"references": [
{
"category": "self",
"summary": "CVE-2025-48596 | NCSC-NL Website",
"url": "https://vulnerabilities.ncsc.nl/csaf/v2/2025/cve-2025-48596.json"
}
],
"title": "CVE-2025-48596"
},
{
"cve": "CVE-2025-48597",
"product_status": {
"known_affected": [
"CSAFPID-1",
"CSAFPID-2"
]
},
"references": [
{
"category": "self",
"summary": "CVE-2025-48597 | NCSC-NL Website",
"url": "https://vulnerabilities.ncsc.nl/csaf/v2/2025/cve-2025-48597.json"
}
],
"title": "CVE-2025-48597"
},
{
"cve": "CVE-2025-48598",
"product_status": {
"known_affected": [
"CSAFPID-1",
"CSAFPID-2"
]
},
"references": [
{
"category": "self",
"summary": "CVE-2025-48598 | NCSC-NL Website",
"url": "https://vulnerabilities.ncsc.nl/csaf/v2/2025/cve-2025-48598.json"
}
],
"title": "CVE-2025-48598"
},
{
"cve": "CVE-2025-48599",
"product_status": {
"known_affected": [
"CSAFPID-1",
"CSAFPID-2"
]
},
"references": [
{
"category": "self",
"summary": "CVE-2025-48599 | NCSC-NL Website",
"url": "https://vulnerabilities.ncsc.nl/csaf/v2/2025/cve-2025-48599.json"
}
],
"title": "CVE-2025-48599"
},
{
"cve": "CVE-2025-48600",
"product_status": {
"known_affected": [
"CSAFPID-1",
"CSAFPID-2"
]
},
"references": [
{
"category": "self",
"summary": "CVE-2025-48600 | NCSC-NL Website",
"url": "https://vulnerabilities.ncsc.nl/csaf/v2/2025/cve-2025-48600.json"
}
],
"title": "CVE-2025-48600"
},
{
"cve": "CVE-2025-48601",
"product_status": {
"known_affected": [
"CSAFPID-1",
"CSAFPID-2"
]
},
"references": [
{
"category": "self",
"summary": "CVE-2025-48601 | NCSC-NL Website",
"url": "https://vulnerabilities.ncsc.nl/csaf/v2/2025/cve-2025-48601.json"
}
],
"title": "CVE-2025-48601"
},
{
"cve": "CVE-2025-48603",
"product_status": {
"known_affected": [
"CSAFPID-1",
"CSAFPID-2"
]
},
"references": [
{
"category": "self",
"summary": "CVE-2025-48603 | NCSC-NL Website",
"url": "https://vulnerabilities.ncsc.nl/csaf/v2/2025/cve-2025-48603.json"
}
],
"title": "CVE-2025-48603"
},
{
"cve": "CVE-2025-48604",
"product_status": {
"known_affected": [
"CSAFPID-1",
"CSAFPID-2"
]
},
"references": [
{
"category": "self",
"summary": "CVE-2025-48604 | NCSC-NL Website",
"url": "https://vulnerabilities.ncsc.nl/csaf/v2/2025/cve-2025-48604.json"
}
],
"title": "CVE-2025-48604"
},
{
"cve": "CVE-2025-48607",
"product_status": {
"known_affected": [
"CSAFPID-1",
"CSAFPID-2"
]
},
"references": [
{
"category": "self",
"summary": "CVE-2025-48607 | NCSC-NL Website",
"url": "https://vulnerabilities.ncsc.nl/csaf/v2/2025/cve-2025-48607.json"
}
],
"title": "CVE-2025-48607"
},
{
"cve": "CVE-2025-48610",
"product_status": {
"known_affected": [
"CSAFPID-1",
"CSAFPID-2"
]
},
"references": [
{
"category": "self",
"summary": "CVE-2025-48610 | NCSC-NL Website",
"url": "https://vulnerabilities.ncsc.nl/csaf/v2/2025/cve-2025-48610.json"
}
],
"title": "CVE-2025-48610"
},
{
"cve": "CVE-2025-48612",
"product_status": {
"known_affected": [
"CSAFPID-1",
"CSAFPID-2"
]
},
"references": [
{
"category": "self",
"summary": "CVE-2025-48612 | NCSC-NL Website",
"url": "https://vulnerabilities.ncsc.nl/csaf/v2/2025/cve-2025-48612.json"
}
],
"title": "CVE-2025-48612"
},
{
"cve": "CVE-2025-48614",
"product_status": {
"known_affected": [
"CSAFPID-1",
"CSAFPID-2"
]
},
"references": [
{
"category": "self",
"summary": "CVE-2025-48614 | NCSC-NL Website",
"url": "https://vulnerabilities.ncsc.nl/csaf/v2/2025/cve-2025-48614.json"
}
],
"title": "CVE-2025-48614"
},
{
"cve": "CVE-2025-48615",
"product_status": {
"known_affected": [
"CSAFPID-1",
"CSAFPID-2"
]
},
"references": [
{
"category": "self",
"summary": "CVE-2025-48615 | NCSC-NL Website",
"url": "https://vulnerabilities.ncsc.nl/csaf/v2/2025/cve-2025-48615.json"
}
],
"title": "CVE-2025-48615"
},
{
"cve": "CVE-2025-48617",
"product_status": {
"known_affected": [
"CSAFPID-1",
"CSAFPID-2"
]
},
"references": [
{
"category": "self",
"summary": "CVE-2025-48617 | NCSC-NL Website",
"url": "https://vulnerabilities.ncsc.nl/csaf/v2/2025/cve-2025-48617.json"
}
],
"title": "CVE-2025-48617"
},
{
"cve": "CVE-2025-48618",
"product_status": {
"known_affected": [
"CSAFPID-1",
"CSAFPID-2"
]
},
"references": [
{
"category": "self",
"summary": "CVE-2025-48618 | NCSC-NL Website",
"url": "https://vulnerabilities.ncsc.nl/csaf/v2/2025/cve-2025-48618.json"
}
],
"title": "CVE-2025-48618"
},
{
"cve": "CVE-2025-48620",
"product_status": {
"known_affected": [
"CSAFPID-1",
"CSAFPID-2"
]
},
"references": [
{
"category": "self",
"summary": "CVE-2025-48620 | NCSC-NL Website",
"url": "https://vulnerabilities.ncsc.nl/csaf/v2/2025/cve-2025-48620.json"
}
],
"title": "CVE-2025-48620"
},
{
"cve": "CVE-2025-48621",
"product_status": {
"known_affected": [
"CSAFPID-1",
"CSAFPID-2"
]
},
"references": [
{
"category": "self",
"summary": "CVE-2025-48621 | NCSC-NL Website",
"url": "https://vulnerabilities.ncsc.nl/csaf/v2/2025/cve-2025-48621.json"
}
],
"title": "CVE-2025-48621"
},
{
"cve": "CVE-2025-48622",
"product_status": {
"known_affected": [
"CSAFPID-1",
"CSAFPID-2"
]
},
"references": [
{
"category": "self",
"summary": "CVE-2025-48622 | NCSC-NL Website",
"url": "https://vulnerabilities.ncsc.nl/csaf/v2/2025/cve-2025-48622.json"
}
],
"title": "CVE-2025-48622"
},
{
"cve": "CVE-2025-48623",
"product_status": {
"known_affected": [
"CSAFPID-1",
"CSAFPID-2"
]
},
"references": [
{
"category": "self",
"summary": "CVE-2025-48623 | NCSC-NL Website",
"url": "https://vulnerabilities.ncsc.nl/csaf/v2/2025/cve-2025-48623.json"
}
],
"title": "CVE-2025-48623"
},
{
"cve": "CVE-2025-48624",
"product_status": {
"known_affected": [
"CSAFPID-1",
"CSAFPID-2"
]
},
"references": [
{
"category": "self",
"summary": "CVE-2025-48624 | NCSC-NL Website",
"url": "https://vulnerabilities.ncsc.nl/csaf/v2/2025/cve-2025-48624.json"
}
],
"title": "CVE-2025-48624"
},
{
"cve": "CVE-2025-48626",
"product_status": {
"known_affected": [
"CSAFPID-1",
"CSAFPID-2"
]
},
"references": [
{
"category": "self",
"summary": "CVE-2025-48626 | NCSC-NL Website",
"url": "https://vulnerabilities.ncsc.nl/csaf/v2/2025/cve-2025-48626.json"
}
],
"title": "CVE-2025-48626"
},
{
"cve": "CVE-2025-48627",
"product_status": {
"known_affected": [
"CSAFPID-1",
"CSAFPID-2"
]
},
"references": [
{
"category": "self",
"summary": "CVE-2025-48627 | NCSC-NL Website",
"url": "https://vulnerabilities.ncsc.nl/csaf/v2/2025/cve-2025-48627.json"
}
],
"title": "CVE-2025-48627"
},
{
"cve": "CVE-2025-48628",
"product_status": {
"known_affected": [
"CSAFPID-1",
"CSAFPID-2"
]
},
"references": [
{
"category": "self",
"summary": "CVE-2025-48628 | NCSC-NL Website",
"url": "https://vulnerabilities.ncsc.nl/csaf/v2/2025/cve-2025-48628.json"
}
],
"title": "CVE-2025-48628"
},
{
"cve": "CVE-2025-48629",
"product_status": {
"known_affected": [
"CSAFPID-1",
"CSAFPID-2"
]
},
"references": [
{
"category": "self",
"summary": "CVE-2025-48629 | NCSC-NL Website",
"url": "https://vulnerabilities.ncsc.nl/csaf/v2/2025/cve-2025-48629.json"
}
],
"title": "CVE-2025-48629"
},
{
"cve": "CVE-2025-48631",
"product_status": {
"known_affected": [
"CSAFPID-1",
"CSAFPID-2"
]
},
"references": [
{
"category": "self",
"summary": "CVE-2025-48631 | NCSC-NL Website",
"url": "https://vulnerabilities.ncsc.nl/csaf/v2/2025/cve-2025-48631.json"
}
],
"title": "CVE-2025-48631"
},
{
"cve": "CVE-2025-48632",
"product_status": {
"known_affected": [
"CSAFPID-1",
"CSAFPID-2"
]
},
"references": [
{
"category": "self",
"summary": "CVE-2025-48632 | NCSC-NL Website",
"url": "https://vulnerabilities.ncsc.nl/csaf/v2/2025/cve-2025-48632.json"
}
],
"title": "CVE-2025-48632"
},
{
"cve": "CVE-2025-48633",
"product_status": {
"known_affected": [
"CSAFPID-1",
"CSAFPID-2"
]
},
"references": [
{
"category": "self",
"summary": "CVE-2025-48633 | NCSC-NL Website",
"url": "https://vulnerabilities.ncsc.nl/csaf/v2/2025/cve-2025-48633.json"
}
],
"title": "CVE-2025-48633"
},
{
"cve": "CVE-2025-48637",
"product_status": {
"known_affected": [
"CSAFPID-1",
"CSAFPID-2"
]
},
"references": [
{
"category": "self",
"summary": "CVE-2025-48637 | NCSC-NL Website",
"url": "https://vulnerabilities.ncsc.nl/csaf/v2/2025/cve-2025-48637.json"
}
],
"title": "CVE-2025-48637"
},
{
"cve": "CVE-2025-48638",
"product_status": {
"known_affected": [
"CSAFPID-1",
"CSAFPID-2"
]
},
"references": [
{
"category": "self",
"summary": "CVE-2025-48638 | NCSC-NL Website",
"url": "https://vulnerabilities.ncsc.nl/csaf/v2/2025/cve-2025-48638.json"
}
],
"title": "CVE-2025-48638"
},
{
"cve": "CVE-2025-48639",
"product_status": {
"known_affected": [
"CSAFPID-1",
"CSAFPID-2"
]
},
"references": [
{
"category": "self",
"summary": "CVE-2025-48639 | NCSC-NL Website",
"url": "https://vulnerabilities.ncsc.nl/csaf/v2/2025/cve-2025-48639.json"
}
],
"title": "CVE-2025-48639"
},
{
"cve": "CVE-2025-58410",
"cwe": {
"id": "CWE-280",
"name": "Improper Handling of Insufficient Permissions or Privileges "
},
"notes": [
{
"category": "other",
"text": "Improper Handling of Insufficient Permissions or Privileges ",
"title": "CWE-280"
},
{
"category": "description",
"text": "Improper GPU system calls allow software running as a non-privileged user to gain unauthorized write access to read-only memory buffers due to inadequate memory protection handling.",
"title": "Summary"
}
],
"product_status": {
"known_affected": [
"CSAFPID-1",
"CSAFPID-2"
]
},
"references": [
{
"category": "self",
"summary": "CVE-2025-58410 | NCSC-NL Website",
"url": "https://vulnerabilities.ncsc.nl/csaf/v2/2025/cve-2025-58410.json"
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 7.5,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
"version": "3.1"
},
"products": [
"CSAFPID-1",
"CSAFPID-2"
]
}
],
"title": "CVE-2025-58410"
},
{
"cve": "CVE-2025-58475",
"notes": [
{
"category": "description",
"text": "Improper input validation in libsec-ril.so prior to the SMR Dec-2025 Release 1 allows local privileged attackers to exploit out-of-bounds memory writing vulnerabilities.",
"title": "Summary"
}
],
"product_status": {
"known_affected": [
"CSAFPID-1",
"CSAFPID-2"
]
},
"references": [
{
"category": "self",
"summary": "CVE-2025-58475 | NCSC-NL Website",
"url": "https://vulnerabilities.ncsc.nl/csaf/v2/2025/cve-2025-58475.json"
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 5.6,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:L/A:L",
"version": "3.1"
},
"products": [
"CSAFPID-1",
"CSAFPID-2"
]
}
],
"title": "CVE-2025-58475"
},
{
"cve": "CVE-2025-58476",
"notes": [
{
"category": "description",
"text": "An out-of-bounds read vulnerability in the bootloader prior to the SMR Dec-2025 Release 1 allows physical attackers to access out-of-bounds memory, posing a significant security risk.",
"title": "Summary"
}
],
"product_status": {
"known_affected": [
"CSAFPID-1",
"CSAFPID-2"
]
},
"references": [
{
"category": "self",
"summary": "CVE-2025-58476 | NCSC-NL Website",
"url": "https://vulnerabilities.ncsc.nl/csaf/v2/2025/cve-2025-58476.json"
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 4.2,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.1/AV:P/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N",
"version": "3.1"
},
"products": [
"CSAFPID-1",
"CSAFPID-2"
]
}
],
"title": "CVE-2025-58476"
},
{
"cve": "CVE-2025-58477",
"notes": [
{
"category": "description",
"text": "An out-of-bounds write vulnerability in libimagecodec.quram.so prior to the SMR Dec-2025 Release 1 allows remote attackers to access out-of-bounds memory, posing a significant security risk.",
"title": "Summary"
}
],
"product_status": {
"known_affected": [
"CSAFPID-1",
"CSAFPID-2"
]
},
"references": [
{
"category": "self",
"summary": "CVE-2025-58477 | NCSC-NL Website",
"url": "https://vulnerabilities.ncsc.nl/csaf/v2/2025/cve-2025-58477.json"
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 4.3,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N",
"version": "3.1"
},
"products": [
"CSAFPID-1",
"CSAFPID-2"
]
}
],
"title": "CVE-2025-58477"
},
{
"cve": "CVE-2025-58478",
"notes": [
{
"category": "description",
"text": "An out-of-bounds write vulnerability in libimagecodec.quram.so prior to the SMR Dec-2025 Release 1 allows remote attackers to access out-of-bounds memory, posing a significant security risk.",
"title": "Summary"
}
],
"product_status": {
"known_affected": [
"CSAFPID-1",
"CSAFPID-2"
]
},
"references": [
{
"category": "self",
"summary": "CVE-2025-58478 | NCSC-NL Website",
"url": "https://vulnerabilities.ncsc.nl/csaf/v2/2025/cve-2025-58478.json"
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 4.3,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N",
"version": "3.1"
},
"products": [
"CSAFPID-1",
"CSAFPID-2"
]
}
],
"title": "CVE-2025-58478"
},
{
"cve": "CVE-2025-58479",
"notes": [
{
"category": "description",
"text": "An out-of-bounds read vulnerability in libimagecodec.quram.so prior to the SMR Dec-2025 Release 1 allows remote attackers to access out-of-bounds memory, posing a security risk.",
"title": "Summary"
}
],
"product_status": {
"known_affected": [
"CSAFPID-1",
"CSAFPID-2"
]
},
"references": [
{
"category": "self",
"summary": "CVE-2025-58479 | NCSC-NL Website",
"url": "https://vulnerabilities.ncsc.nl/csaf/v2/2025/cve-2025-58479.json"
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 4.3,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N",
"version": "3.1"
},
"products": [
"CSAFPID-1",
"CSAFPID-2"
]
}
],
"title": "CVE-2025-58479"
},
{
"cve": "CVE-2025-58480",
"notes": [
{
"category": "description",
"text": "A heap-based buffer overflow vulnerability in libimagecodec.quram.so prior to the SMR Dec-2025 Release 1 allows remote attackers to exploit out-of-bounds memory access.",
"title": "Summary"
}
],
"product_status": {
"known_affected": [
"CSAFPID-1",
"CSAFPID-2"
]
},
"references": [
{
"category": "self",
"summary": "CVE-2025-58480 | NCSC-NL Website",
"url": "https://vulnerabilities.ncsc.nl/csaf/v2/2025/cve-2025-58480.json"
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 4.3,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N",
"version": "3.1"
},
"products": [
"CSAFPID-1",
"CSAFPID-2"
]
}
],
"title": "CVE-2025-58480"
},
{
"cve": "CVE-2025-61607",
"notes": [
{
"category": "description",
"text": "The nr modem is susceptible to a remote denial of service due to inadequate input validation, potentially leading to a system crash without requiring additional execution privileges.",
"title": "Summary"
},
{
"category": "general",
"text": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"title": "CVSSV4"
}
],
"product_status": {
"known_affected": [
"CSAFPID-1",
"CSAFPID-2"
]
},
"references": [
{
"category": "self",
"summary": "CVE-2025-61607 | NCSC-NL Website",
"url": "https://vulnerabilities.ncsc.nl/csaf/v2/2025/cve-2025-61607.json"
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 7.5,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
},
"products": [
"CSAFPID-1",
"CSAFPID-2"
]
}
],
"title": "CVE-2025-61607"
},
{
"cve": "CVE-2025-61608",
"notes": [
{
"category": "description",
"text": "The nr modem is susceptible to a remote denial of service due to inadequate input validation, potentially leading to a system crash without requiring additional execution privileges.",
"title": "Summary"
},
{
"category": "general",
"text": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"title": "CVSSV4"
}
],
"product_status": {
"known_affected": [
"CSAFPID-1",
"CSAFPID-2"
]
},
"references": [
{
"category": "self",
"summary": "CVE-2025-61608 | NCSC-NL Website",
"url": "https://vulnerabilities.ncsc.nl/csaf/v2/2025/cve-2025-61608.json"
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 7.5,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
},
"products": [
"CSAFPID-1",
"CSAFPID-2"
]
}
],
"title": "CVE-2025-61608"
},
{
"cve": "CVE-2025-61609",
"notes": [
{
"category": "description",
"text": "The document identifies a vulnerability in a modem that may lead to a remote denial of service due to insufficient input validation, potentially causing a system crash without requiring additional execution privileges.",
"title": "Summary"
},
{
"category": "general",
"text": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"title": "CVSSV4"
}
],
"product_status": {
"known_affected": [
"CSAFPID-1",
"CSAFPID-2"
]
},
"references": [
{
"category": "self",
"summary": "CVE-2025-61609 | NCSC-NL Website",
"url": "https://vulnerabilities.ncsc.nl/csaf/v2/2025/cve-2025-61609.json"
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 7.5,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
},
"products": [
"CSAFPID-1",
"CSAFPID-2"
]
}
],
"title": "CVE-2025-61609"
},
{
"cve": "CVE-2025-61610",
"notes": [
{
"category": "description",
"text": "The nr modem is susceptible to a remote denial of service due to inadequate input validation, potentially leading to a system crash without requiring additional execution privileges.",
"title": "Summary"
},
{
"category": "general",
"text": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"title": "CVSSV4"
}
],
"product_status": {
"known_affected": [
"CSAFPID-1",
"CSAFPID-2"
]
},
"references": [
{
"category": "self",
"summary": "CVE-2025-61610 | NCSC-NL Website",
"url": "https://vulnerabilities.ncsc.nl/csaf/v2/2025/cve-2025-61610.json"
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 7.5,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
},
"products": [
"CSAFPID-1",
"CSAFPID-2"
]
}
],
"title": "CVE-2025-61610"
},
{
"cve": "CVE-2025-61617",
"notes": [
{
"category": "description",
"text": "The nr modem is susceptible to a remote denial of service due to inadequate input validation, potentially leading to a system crash without requiring additional execution privileges.",
"title": "Summary"
},
{
"category": "general",
"text": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"title": "CVSSV4"
}
],
"product_status": {
"known_affected": [
"CSAFPID-1",
"CSAFPID-2"
]
},
"references": [
{
"category": "self",
"summary": "CVE-2025-61617 | NCSC-NL Website",
"url": "https://vulnerabilities.ncsc.nl/csaf/v2/2025/cve-2025-61617.json"
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 7.5,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
},
"products": [
"CSAFPID-1",
"CSAFPID-2"
]
}
],
"title": "CVE-2025-61617"
},
{
"cve": "CVE-2025-61618",
"notes": [
{
"category": "description",
"text": "The nr modem is susceptible to a remote denial of service due to inadequate input validation, potentially leading to a system crash without requiring additional execution privileges.",
"title": "Summary"
},
{
"category": "general",
"text": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"title": "CVSSV4"
}
],
"product_status": {
"known_affected": [
"CSAFPID-1",
"CSAFPID-2"
]
},
"references": [
{
"category": "self",
"summary": "CVE-2025-61618 | NCSC-NL Website",
"url": "https://vulnerabilities.ncsc.nl/csaf/v2/2025/cve-2025-61618.json"
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 7.5,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
},
"products": [
"CSAFPID-1",
"CSAFPID-2"
]
}
],
"title": "CVE-2025-61618"
},
{
"cve": "CVE-2025-61619",
"notes": [
{
"category": "description",
"text": "The nr modem is susceptible to a remote denial of service due to inadequate input validation, potentially leading to a system crash without requiring additional execution privileges.",
"title": "Summary"
},
{
"category": "general",
"text": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"title": "CVSSV4"
}
],
"product_status": {
"known_affected": [
"CSAFPID-1",
"CSAFPID-2"
]
},
"references": [
{
"category": "self",
"summary": "CVE-2025-61619 | NCSC-NL Website",
"url": "https://vulnerabilities.ncsc.nl/csaf/v2/2025/cve-2025-61619.json"
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 7.5,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
},
"products": [
"CSAFPID-1",
"CSAFPID-2"
]
}
],
"title": "CVE-2025-61619"
}
]
}
CERTFR-2025-AVI-1056
Vulnerability from certfr_avis - Published: 2025-12-02 - Updated: 2025-12-02
De multiples vulnérabilités ont été découvertes dans Google Android. Elles permettent à un attaquant de provoquer une exécution de code arbitraire à distance, une atteinte à la confidentialité des données et un déni de service.
Google indique que les vulnérabilités CVE-2025-48633 et CVE-2025-48572 sont activement exploitées.
Solutions
Se référer au bulletin de sécurité de l'éditeur pour l'obtention des correctifs (cf. section Documentation).
Impacted products
References
| Title | Publication Time | Tags | |||
|---|---|---|---|---|---|
|
|||||
{
"$ref": "https://www.cert.ssi.gouv.fr/openapi.json",
"affected_systems": [
{
"description": "Android versions ant\u00e9rieures \u00e0 13, 14, 15 et 16 avant le correctif du 1 d\u00e9cembre 2025",
"product": {
"name": "Android",
"vendor": {
"name": "Google",
"scada": false
}
}
}
],
"affected_systems_content": "",
"content": "## Solutions\n\nSe r\u00e9f\u00e9rer au bulletin de s\u00e9curit\u00e9 de l\u0027\u00e9diteur pour l\u0027obtention des correctifs (cf. section Documentation).",
"cves": [
{
"name": "CVE-2025-11132",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-11132"
},
{
"name": "CVE-2025-48629",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-48629"
},
{
"name": "CVE-2025-61619",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-61619"
},
{
"name": "CVE-2025-61618",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-61618"
},
{
"name": "CVE-2025-48555",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-48555"
},
{
"name": "CVE-2025-48607",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-48607"
},
{
"name": "CVE-2025-48573",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-48573"
},
{
"name": "CVE-2025-27053",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-27053"
},
{
"name": "CVE-2025-48624",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-48624"
},
{
"name": "CVE-2025-8045",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-8045"
},
{
"name": "CVE-2025-48566",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-48566"
},
{
"name": "CVE-2025-48632",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-48632"
},
{
"name": "CVE-2025-48603",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-48603"
},
{
"name": "CVE-2025-48597",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-48597"
},
{
"name": "CVE-2025-47319",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-47319"
},
{
"name": "CVE-2025-48628",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-48628"
},
{
"name": "CVE-2025-48580",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-48580"
},
{
"name": "CVE-2025-48592",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-48592"
},
{
"name": "CVE-2025-61608",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-61608"
},
{
"name": "CVE-2025-38500",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-38500"
},
{
"name": "CVE-2025-20758",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-20758"
},
{
"name": "CVE-2025-20790",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-20790"
},
{
"name": "CVE-2025-48536",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-48536"
},
{
"name": "CVE-2025-31718",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-31718"
},
{
"name": "CVE-2025-48575",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-48575"
},
{
"name": "CVE-2023-40130",
"url": "https://www.cve.org/CVERecord?id=CVE-2023-40130"
},
{
"name": "CVE-2025-48565",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-48565"
},
{
"name": "CVE-2025-22420",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-22420"
},
{
"name": "CVE-2025-47323",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-47323"
},
{
"name": "CVE-2025-48638",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-48638"
},
{
"name": "CVE-2025-48596",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-48596"
},
{
"name": "CVE-2025-48600",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-48600"
},
{
"name": "CVE-2025-48622",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-48622"
},
{
"name": "CVE-2025-20751",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-20751"
},
{
"name": "CVE-2025-20757",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-20757"
},
{
"name": "CVE-2025-20730",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-20730"
},
{
"name": "CVE-2025-48589",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-48589"
},
{
"name": "CVE-2025-32319",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-32319"
},
{
"name": "CVE-2025-48576",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-48576"
},
{
"name": "CVE-2025-20791",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-20791"
},
{
"name": "CVE-2025-48588",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-48588"
},
{
"name": "CVE-2025-48583",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-48583"
},
{
"name": "CVE-2025-20750",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-20750"
},
{
"name": "CVE-2025-46711",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-46711"
},
{
"name": "CVE-2025-48612",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-48612"
},
{
"name": "CVE-2025-47382",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-47382"
},
{
"name": "CVE-2025-31717",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-31717"
},
{
"name": "CVE-2025-27074",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-27074"
},
{
"name": "CVE-2025-32328",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-32328"
},
{
"name": "CVE-2025-48601",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-48601"
},
{
"name": "CVE-2025-48627",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-48627"
},
{
"name": "CVE-2025-61607",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-61607"
},
{
"name": "CVE-2025-20755",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-20755"
},
{
"name": "CVE-2025-20756",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-20756"
},
{
"name": "CVE-2025-48618",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-48618"
},
{
"name": "CVE-2025-22432",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-22432"
},
{
"name": "CVE-2025-48525",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-48525"
},
{
"name": "CVE-2025-47351",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-47351"
},
{
"name": "CVE-2025-47354",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-47354"
},
{
"name": "CVE-2025-11131",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-11131"
},
{
"name": "CVE-2025-47370",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-47370"
},
{
"name": "CVE-2025-48594",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-48594"
},
{
"name": "CVE-2025-48620",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-48620"
},
{
"name": "CVE-2025-61610",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-61610"
},
{
"name": "CVE-2025-47372",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-47372"
},
{
"name": "CVE-2025-48637",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-48637"
},
{
"name": "CVE-2025-6573",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-6573"
},
{
"name": "CVE-2025-20725",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-20725"
},
{
"name": "CVE-2025-20726",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-20726"
},
{
"name": "CVE-2025-3012",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-3012"
},
{
"name": "CVE-2025-61609",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-61609"
},
{
"name": "CVE-2025-58410",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-58410"
},
{
"name": "CVE-2025-48621",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-48621"
},
{
"name": "CVE-2025-25177",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-25177"
},
{
"name": "CVE-2025-48631",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-48631"
},
{
"name": "CVE-2025-48564",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-48564"
},
{
"name": "CVE-2025-48639",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-48639"
},
{
"name": "CVE-2025-27070",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-27070"
},
{
"name": "CVE-2025-27054",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-27054"
},
{
"name": "CVE-2025-20753",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-20753"
},
{
"name": "CVE-2025-48633",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-48633"
},
{
"name": "CVE-2025-48599",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-48599"
},
{
"name": "CVE-2025-38236",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-38236"
},
{
"name": "CVE-2025-48626",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-48626"
},
{
"name": "CVE-2025-48591",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-48591"
},
{
"name": "CVE-2025-6349",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-6349"
},
{
"name": "CVE-2025-48604",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-48604"
},
{
"name": "CVE-2025-48615",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-48615"
},
{
"name": "CVE-2025-48584",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-48584"
},
{
"name": "CVE-2025-20759",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-20759"
},
{
"name": "CVE-2025-38349",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-38349"
},
{
"name": "CVE-2025-48572",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-48572"
},
{
"name": "CVE-2025-48598",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-48598"
},
{
"name": "CVE-2025-48590",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-48590"
},
{
"name": "CVE-2025-48586",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-48586"
},
{
"name": "CVE-2025-20792",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-20792"
},
{
"name": "CVE-2025-32329",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-32329"
},
{
"name": "CVE-2024-35970",
"url": "https://www.cve.org/CVERecord?id=CVE-2024-35970"
},
{
"name": "CVE-2025-48610",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-48610"
},
{
"name": "CVE-2025-20752",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-20752"
},
{
"name": "CVE-2025-20727",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-20727"
},
{
"name": "CVE-2025-20754",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-20754"
},
{
"name": "CVE-2025-61617",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-61617"
},
{
"name": "CVE-2025-48617",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-48617"
},
{
"name": "CVE-2025-48614",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-48614"
},
{
"name": "CVE-2025-48623",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-48623"
},
{
"name": "CVE-2025-11133",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-11133"
}
],
"initial_release_date": "2025-12-02T00:00:00",
"last_revision_date": "2025-12-02T00:00:00",
"links": [],
"reference": "CERTFR-2025-AVI-1056",
"revisions": [
{
"description": "Version initiale",
"revision_date": "2025-12-02T00:00:00.000000"
}
],
"risks": [
{
"description": "Ex\u00e9cution de code arbitraire \u00e0 distance"
},
{
"description": "D\u00e9ni de service"
},
{
"description": "Atteinte \u00e0 la confidentialit\u00e9 des donn\u00e9es"
}
],
"summary": "De multiples vuln\u00e9rabilit\u00e9s ont \u00e9t\u00e9 d\u00e9couvertes dans Google Android. Elles permettent \u00e0 un attaquant de provoquer une ex\u00e9cution de code arbitraire \u00e0 distance, une atteinte \u00e0 la confidentialit\u00e9 des donn\u00e9es et un d\u00e9ni de service.\n\nGoogle indique que les vuln\u00e9rabilit\u00e9s CVE-2025-48633 et CVE-2025-48572 sont activement exploit\u00e9es.",
"title": "Multiples vuln\u00e9rabilit\u00e9s dans Google Android",
"vendor_advisories": [
{
"published_at": "2025-12-01",
"title": "Bulletin de s\u00e9curit\u00e9 Google Android",
"url": "https://source.android.com/docs/security/bulletin/2025-12-01?hl=fr"
}
]
}
CERTFR-2025-AVI-1056
Vulnerability from certfr_avis - Published: 2025-12-02 - Updated: 2025-12-02
De multiples vulnérabilités ont été découvertes dans Google Android. Elles permettent à un attaquant de provoquer une exécution de code arbitraire à distance, une atteinte à la confidentialité des données et un déni de service.
Google indique que les vulnérabilités CVE-2025-48633 et CVE-2025-48572 sont activement exploitées.
Solutions
Se référer au bulletin de sécurité de l'éditeur pour l'obtention des correctifs (cf. section Documentation).
Impacted products
References
| Title | Publication Time | Tags | |||
|---|---|---|---|---|---|
|
|||||
{
"$ref": "https://www.cert.ssi.gouv.fr/openapi.json",
"affected_systems": [
{
"description": "Android versions ant\u00e9rieures \u00e0 13, 14, 15 et 16 avant le correctif du 1 d\u00e9cembre 2025",
"product": {
"name": "Android",
"vendor": {
"name": "Google",
"scada": false
}
}
}
],
"affected_systems_content": "",
"content": "## Solutions\n\nSe r\u00e9f\u00e9rer au bulletin de s\u00e9curit\u00e9 de l\u0027\u00e9diteur pour l\u0027obtention des correctifs (cf. section Documentation).",
"cves": [
{
"name": "CVE-2025-11132",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-11132"
},
{
"name": "CVE-2025-48629",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-48629"
},
{
"name": "CVE-2025-61619",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-61619"
},
{
"name": "CVE-2025-61618",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-61618"
},
{
"name": "CVE-2025-48555",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-48555"
},
{
"name": "CVE-2025-48607",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-48607"
},
{
"name": "CVE-2025-48573",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-48573"
},
{
"name": "CVE-2025-27053",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-27053"
},
{
"name": "CVE-2025-48624",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-48624"
},
{
"name": "CVE-2025-8045",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-8045"
},
{
"name": "CVE-2025-48566",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-48566"
},
{
"name": "CVE-2025-48632",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-48632"
},
{
"name": "CVE-2025-48603",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-48603"
},
{
"name": "CVE-2025-48597",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-48597"
},
{
"name": "CVE-2025-47319",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-47319"
},
{
"name": "CVE-2025-48628",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-48628"
},
{
"name": "CVE-2025-48580",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-48580"
},
{
"name": "CVE-2025-48592",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-48592"
},
{
"name": "CVE-2025-61608",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-61608"
},
{
"name": "CVE-2025-38500",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-38500"
},
{
"name": "CVE-2025-20758",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-20758"
},
{
"name": "CVE-2025-20790",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-20790"
},
{
"name": "CVE-2025-48536",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-48536"
},
{
"name": "CVE-2025-31718",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-31718"
},
{
"name": "CVE-2025-48575",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-48575"
},
{
"name": "CVE-2023-40130",
"url": "https://www.cve.org/CVERecord?id=CVE-2023-40130"
},
{
"name": "CVE-2025-48565",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-48565"
},
{
"name": "CVE-2025-22420",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-22420"
},
{
"name": "CVE-2025-47323",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-47323"
},
{
"name": "CVE-2025-48638",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-48638"
},
{
"name": "CVE-2025-48596",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-48596"
},
{
"name": "CVE-2025-48600",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-48600"
},
{
"name": "CVE-2025-48622",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-48622"
},
{
"name": "CVE-2025-20751",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-20751"
},
{
"name": "CVE-2025-20757",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-20757"
},
{
"name": "CVE-2025-20730",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-20730"
},
{
"name": "CVE-2025-48589",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-48589"
},
{
"name": "CVE-2025-32319",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-32319"
},
{
"name": "CVE-2025-48576",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-48576"
},
{
"name": "CVE-2025-20791",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-20791"
},
{
"name": "CVE-2025-48588",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-48588"
},
{
"name": "CVE-2025-48583",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-48583"
},
{
"name": "CVE-2025-20750",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-20750"
},
{
"name": "CVE-2025-46711",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-46711"
},
{
"name": "CVE-2025-48612",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-48612"
},
{
"name": "CVE-2025-47382",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-47382"
},
{
"name": "CVE-2025-31717",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-31717"
},
{
"name": "CVE-2025-27074",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-27074"
},
{
"name": "CVE-2025-32328",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-32328"
},
{
"name": "CVE-2025-48601",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-48601"
},
{
"name": "CVE-2025-48627",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-48627"
},
{
"name": "CVE-2025-61607",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-61607"
},
{
"name": "CVE-2025-20755",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-20755"
},
{
"name": "CVE-2025-20756",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-20756"
},
{
"name": "CVE-2025-48618",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-48618"
},
{
"name": "CVE-2025-22432",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-22432"
},
{
"name": "CVE-2025-48525",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-48525"
},
{
"name": "CVE-2025-47351",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-47351"
},
{
"name": "CVE-2025-47354",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-47354"
},
{
"name": "CVE-2025-11131",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-11131"
},
{
"name": "CVE-2025-47370",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-47370"
},
{
"name": "CVE-2025-48594",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-48594"
},
{
"name": "CVE-2025-48620",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-48620"
},
{
"name": "CVE-2025-61610",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-61610"
},
{
"name": "CVE-2025-47372",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-47372"
},
{
"name": "CVE-2025-48637",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-48637"
},
{
"name": "CVE-2025-6573",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-6573"
},
{
"name": "CVE-2025-20725",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-20725"
},
{
"name": "CVE-2025-20726",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-20726"
},
{
"name": "CVE-2025-3012",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-3012"
},
{
"name": "CVE-2025-61609",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-61609"
},
{
"name": "CVE-2025-58410",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-58410"
},
{
"name": "CVE-2025-48621",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-48621"
},
{
"name": "CVE-2025-25177",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-25177"
},
{
"name": "CVE-2025-48631",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-48631"
},
{
"name": "CVE-2025-48564",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-48564"
},
{
"name": "CVE-2025-48639",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-48639"
},
{
"name": "CVE-2025-27070",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-27070"
},
{
"name": "CVE-2025-27054",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-27054"
},
{
"name": "CVE-2025-20753",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-20753"
},
{
"name": "CVE-2025-48633",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-48633"
},
{
"name": "CVE-2025-48599",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-48599"
},
{
"name": "CVE-2025-38236",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-38236"
},
{
"name": "CVE-2025-48626",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-48626"
},
{
"name": "CVE-2025-48591",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-48591"
},
{
"name": "CVE-2025-6349",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-6349"
},
{
"name": "CVE-2025-48604",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-48604"
},
{
"name": "CVE-2025-48615",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-48615"
},
{
"name": "CVE-2025-48584",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-48584"
},
{
"name": "CVE-2025-20759",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-20759"
},
{
"name": "CVE-2025-38349",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-38349"
},
{
"name": "CVE-2025-48572",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-48572"
},
{
"name": "CVE-2025-48598",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-48598"
},
{
"name": "CVE-2025-48590",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-48590"
},
{
"name": "CVE-2025-48586",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-48586"
},
{
"name": "CVE-2025-20792",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-20792"
},
{
"name": "CVE-2025-32329",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-32329"
},
{
"name": "CVE-2024-35970",
"url": "https://www.cve.org/CVERecord?id=CVE-2024-35970"
},
{
"name": "CVE-2025-48610",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-48610"
},
{
"name": "CVE-2025-20752",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-20752"
},
{
"name": "CVE-2025-20727",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-20727"
},
{
"name": "CVE-2025-20754",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-20754"
},
{
"name": "CVE-2025-61617",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-61617"
},
{
"name": "CVE-2025-48617",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-48617"
},
{
"name": "CVE-2025-48614",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-48614"
},
{
"name": "CVE-2025-48623",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-48623"
},
{
"name": "CVE-2025-11133",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-11133"
}
],
"initial_release_date": "2025-12-02T00:00:00",
"last_revision_date": "2025-12-02T00:00:00",
"links": [],
"reference": "CERTFR-2025-AVI-1056",
"revisions": [
{
"description": "Version initiale",
"revision_date": "2025-12-02T00:00:00.000000"
}
],
"risks": [
{
"description": "Ex\u00e9cution de code arbitraire \u00e0 distance"
},
{
"description": "D\u00e9ni de service"
},
{
"description": "Atteinte \u00e0 la confidentialit\u00e9 des donn\u00e9es"
}
],
"summary": "De multiples vuln\u00e9rabilit\u00e9s ont \u00e9t\u00e9 d\u00e9couvertes dans Google Android. Elles permettent \u00e0 un attaquant de provoquer une ex\u00e9cution de code arbitraire \u00e0 distance, une atteinte \u00e0 la confidentialit\u00e9 des donn\u00e9es et un d\u00e9ni de service.\n\nGoogle indique que les vuln\u00e9rabilit\u00e9s CVE-2025-48633 et CVE-2025-48572 sont activement exploit\u00e9es.",
"title": "Multiples vuln\u00e9rabilit\u00e9s dans Google Android",
"vendor_advisories": [
{
"published_at": "2025-12-01",
"title": "Bulletin de s\u00e9curit\u00e9 Google Android",
"url": "https://source.android.com/docs/security/bulletin/2025-12-01?hl=fr"
}
]
}
FKIE_CVE-2025-20751
Vulnerability from fkie_nvd - Published: 2025-12-02 03:16 - Updated: 2025-12-04 13:54
Severity ?
Summary
In Modem, there is a possible system crash due to a missing bounds check. This could lead to remote denial of service, if a UE has connected to a rogue base station controlled by the attacker, with no additional execution privileges needed. User interaction is not needed for exploitation. Patch ID: MOLY01661195; Issue ID: MSV-4297.
References
| URL | Tags | ||
|---|---|---|---|
| security@mediatek.com | https://corp.mediatek.com/product-security-bulletin/December-2025 | Vendor Advisory |
Impacted products
| Vendor | Product | Version | |
|---|---|---|---|
| mediatek | nr15 | - | |
| mediatek | mt2735 | - | |
| mediatek | mt6833 | - | |
| mediatek | mt6833p | - | |
| mediatek | mt6853 | - | |
| mediatek | mt6853t | - | |
| mediatek | mt6855 | - | |
| mediatek | mt6855t | - | |
| mediatek | mt6873 | - | |
| mediatek | mt6875 | - | |
| mediatek | mt6875t | - | |
| mediatek | mt6877 | - | |
| mediatek | mt6877t | - | |
| mediatek | mt6877tt | - | |
| mediatek | mt6880 | - | |
| mediatek | mt6883 | - | |
| mediatek | mt6885 | - | |
| mediatek | mt6889 | - | |
| mediatek | mt6890 | - | |
| mediatek | mt6891 | - | |
| mediatek | mt6893 | - | |
| mediatek | mt8675 | - | |
| mediatek | mt8771 | - | |
| mediatek | mt8791 | - | |
| mediatek | mt8791t | - | |
| mediatek | mt8797 | - |
{
"configurations": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:mediatek:nr15:-:*:*:*:*:*:*:*",
"matchCriteriaId": "E30A2D2E-6A72-4070-A471-EEE75F7D07F2",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
},
{
"cpeMatch": [
{
"criteria": "cpe:2.3:h:mediatek:mt2735:-:*:*:*:*:*:*:*",
"matchCriteriaId": "7F1D09FC-5BE9-4B23-82F1-3C6EAC5711A6",
"vulnerable": false
},
{
"criteria": "cpe:2.3:h:mediatek:mt6833:-:*:*:*:*:*:*:*",
"matchCriteriaId": "9814939B-F05E-4870-90C0-7C0F6BAAEB39",
"vulnerable": false
},
{
"criteria": "cpe:2.3:h:mediatek:mt6833p:-:*:*:*:*:*:*:*",
"matchCriteriaId": "CB690F5A-9367-45D3-A53E-80BF60053630",
"vulnerable": false
},
{
"criteria": "cpe:2.3:h:mediatek:mt6853:-:*:*:*:*:*:*:*",
"matchCriteriaId": "366F1912-756B-443E-9962-224937DD7DFB",
"vulnerable": false
},
{
"criteria": "cpe:2.3:h:mediatek:mt6853t:-:*:*:*:*:*:*:*",
"matchCriteriaId": "328DA6BE-1303-4646-89B7-2EC8DC444532",
"vulnerable": false
},
{
"criteria": "cpe:2.3:h:mediatek:mt6855:-:*:*:*:*:*:*:*",
"matchCriteriaId": "89AFEE24-7AAD-4EDB-8C3E-EDBA3240730A",
"vulnerable": false
},
{
"criteria": "cpe:2.3:h:mediatek:mt6855t:-:*:*:*:*:*:*:*",
"matchCriteriaId": "083F6134-FF26-4F1B-9B77-971D342AF774",
"vulnerable": false
},
{
"criteria": "cpe:2.3:h:mediatek:mt6873:-:*:*:*:*:*:*:*",
"matchCriteriaId": "F6B8A36E-C5FB-44AE-A1C3-50EBF4C68F6B",
"vulnerable": false
},
{
"criteria": "cpe:2.3:h:mediatek:mt6875:-:*:*:*:*:*:*:*",
"matchCriteriaId": "80BDC5EC-E822-4BC7-8C0D-E8AD8396E8FE",
"vulnerable": false
},
{
"criteria": "cpe:2.3:h:mediatek:mt6875t:-:*:*:*:*:*:*:*",
"matchCriteriaId": "F883C6D3-1724-4553-9EFC-3D204FF3CAA3",
"vulnerable": false
},
{
"criteria": "cpe:2.3:h:mediatek:mt6877:-:*:*:*:*:*:*:*",
"matchCriteriaId": "7CA9352F-E9BD-4656-9B7C-4AFEE2C78E58",
"vulnerable": false
},
{
"criteria": "cpe:2.3:h:mediatek:mt6877t:-:*:*:*:*:*:*:*",
"matchCriteriaId": "EFA54AA1-4E3A-44F8-A222-31C60F8F81DA",
"vulnerable": false
},
{
"criteria": "cpe:2.3:h:mediatek:mt6877tt:-:*:*:*:*:*:*:*",
"matchCriteriaId": "5D4D6885-E18C-477F-8B6D-B9E84D9535E2",
"vulnerable": false
},
{
"criteria": "cpe:2.3:h:mediatek:mt6880:-:*:*:*:*:*:*:*",
"matchCriteriaId": "68CF4A7A-3136-4C4C-A795-81323896BE11",
"vulnerable": false
},
{
"criteria": "cpe:2.3:h:mediatek:mt6883:-:*:*:*:*:*:*:*",
"matchCriteriaId": "15E2EC3F-9FB3-488B-B1C1-2793A416C755",
"vulnerable": false
},
{
"criteria": "cpe:2.3:h:mediatek:mt6885:-:*:*:*:*:*:*:*",
"matchCriteriaId": "DD64413C-C774-4C4F-9551-89E1AA9469EE",
"vulnerable": false
},
{
"criteria": "cpe:2.3:h:mediatek:mt6889:-:*:*:*:*:*:*:*",
"matchCriteriaId": "3B787DC3-8E5A-4968-B20B-37B6257FAAE2",
"vulnerable": false
},
{
"criteria": "cpe:2.3:h:mediatek:mt6890:-:*:*:*:*:*:*:*",
"matchCriteriaId": "171D1C08-F055-44C0-913C-AA2B73AF5B72",
"vulnerable": false
},
{
"criteria": "cpe:2.3:h:mediatek:mt6891:-:*:*:*:*:*:*:*",
"matchCriteriaId": "D8E91CA4-CA5B-40D1-9A96-2B875104BCF4",
"vulnerable": false
},
{
"criteria": "cpe:2.3:h:mediatek:mt6893:-:*:*:*:*:*:*:*",
"matchCriteriaId": "213B5C7F-D965-4312-9CDF-4F06FA77D401",
"vulnerable": false
},
{
"criteria": "cpe:2.3:h:mediatek:mt8675:-:*:*:*:*:*:*:*",
"matchCriteriaId": "03E6123A-7603-4EAB-AFFB-229E8A040709",
"vulnerable": false
},
{
"criteria": "cpe:2.3:h:mediatek:mt8771:-:*:*:*:*:*:*:*",
"matchCriteriaId": "0D09F23D-D023-4A60-B426-61251FDD8A5A",
"vulnerable": false
},
{
"criteria": "cpe:2.3:h:mediatek:mt8791:-:*:*:*:*:*:*:*",
"matchCriteriaId": "9CD2C3EC-B62D-4616-964F-FDBE5B14A449",
"vulnerable": false
},
{
"criteria": "cpe:2.3:h:mediatek:mt8791t:-:*:*:*:*:*:*:*",
"matchCriteriaId": "1BB05B1D-77C9-4E42-91AD-9F087413DC20",
"vulnerable": false
},
{
"criteria": "cpe:2.3:h:mediatek:mt8797:-:*:*:*:*:*:*:*",
"matchCriteriaId": "2B469BF4-5961-42E9-814B-1BE06D182E45",
"vulnerable": false
}
],
"negate": false,
"operator": "OR"
}
],
"operator": "AND"
}
],
"cveTags": [],
"descriptions": [
{
"lang": "en",
"value": "In Modem, there is a possible system crash due to a missing bounds check. This could lead to remote denial of service, if a UE has connected to a rogue base station controlled by the attacker, with no additional execution privileges needed. User interaction is not needed for exploitation. Patch ID: MOLY01661195; Issue ID: MSV-4297."
}
],
"id": "CVE-2025-20751",
"lastModified": "2025-12-04T13:54:15.220",
"metrics": {
"cvssMetricV31": [
{
"cvssData": {
"attackComplexity": "HIGH",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 5.3,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
},
"exploitabilityScore": 1.6,
"impactScore": 3.6,
"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"type": "Secondary"
}
]
},
"published": "2025-12-02T03:16:16.213",
"references": [
{
"source": "security@mediatek.com",
"tags": [
"Vendor Advisory"
],
"url": "https://corp.mediatek.com/product-security-bulletin/December-2025"
}
],
"sourceIdentifier": "security@mediatek.com",
"vulnStatus": "Analyzed",
"weaknesses": [
{
"description": [
{
"lang": "en",
"value": "CWE-787"
}
],
"source": "security@mediatek.com",
"type": "Secondary"
}
]
}
Loading…
Loading…
Sightings
| Author | Source | Type | Date |
|---|
Nomenclature
- Seen: The vulnerability was mentioned, discussed, or observed by the user.
- Confirmed: The vulnerability has been validated from an analyst's perspective.
- Published Proof of Concept: A public proof of concept is available for this vulnerability.
- Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
- Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
- Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
- Not confirmed: The user expressed doubt about the validity of the vulnerability.
- Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.
Loading…
Loading…