CRITICAL🇵🇱 Wersja polska

CVE-2025-21450

CVSS 9.1v3.1pub. 2025-07-08upd. 2025-08-11

Cryptographic issue occurs due to use of insecure connection method while downloading.

🤖 AI Analysis
How it works

The vulnerability stems from the use of an unsecured connection method in the data download process by device firmware (CWE-287: Improper Authentication, CWE-863: Incorrect Authorization). The lack of appropriate cryptographic mechanisms allows an attacker to conduct an attack without prior authentication, over the network, without requiring any privileges or user interaction. Network attack vector (AV:N) combined with low attack complexity (AC:L) makes this vulnerability particularly dangerous.

Impact

An attacker can gain unauthorized access to sensitive data (high confidentiality) and perform unauthorized modifications to data or system resources (high integrity) on the vulnerable device.

Mitigation & patch

Apply patches available from the manufacturer according to references — Qualcomm security bulletin from July 2025 (https://docs.qualcomm.com/product/publicresources/securitybulletin/july-2025-bulletin.html)

Who is affected

Firmware of the following Qualcomm chipsets: SM6650P, QCA6688AQ, WCN7881, QCA6574A, WCD9375 — specific versions indicated in manufacturer references

Analysis generated by Claude AI (Anthropic) based on NVD data. Always verify with vendor.
CVSS Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N

  • Qualcomm Ar8035

    HW
    Qualcomm
    all versions

  • Qualcomm Ar8035 Firmware

    OS
    Qualcomm
    all versions

  • Qualcomm Fastconnect 6200

    HW
    Qualcomm
    all versions

  • Qualcomm Fastconnect 6200 Firmware

    OS
    Qualcomm
    all versions

  • Qualcomm Fastconnect 6700

    HW
    Qualcomm
    all versions

  • Qualcomm Fastconnect 6700 Firmware

    OS
    Qualcomm
    all versions

  • Qualcomm Fastconnect 6900

    HW
    Qualcomm
    all versions

  • Qualcomm Fastconnect 6900 Firmware

    OS
    Qualcomm
    all versions

  • Qualcomm Fastconnect 7800

    HW
    Qualcomm
    all versions

  • Qualcomm Fastconnect 7800 Firmware

    OS
    Qualcomm
    all versions

  • Qualcomm Qca6174a

    HW
    Qualcomm
    all versions

  • Qualcomm Qca6174a Firmware

    OS
    Qualcomm
    all versions

  • Qualcomm Qca6391

    HW
    Qualcomm
    all versions

  • Qualcomm Qca6391 Firmware

    OS
    Qualcomm
    all versions

  • Qualcomm Qca6574a

    HW
    Qualcomm
    all versions

  • Qualcomm Qca6574a Firmware

    OS
    Qualcomm
    all versions

  • Qualcomm Qca6574au

    HW
    Qualcomm
    all versions

  • Qualcomm Qca6574au Firmware

    OS
    Qualcomm
    all versions

  • Qualcomm Qca6584au

    HW
    Qualcomm
    all versions

  • Qualcomm Qca6584au Firmware

    OS
    Qualcomm
    all versions

  • Qualcomm Qca6595au

    HW
    Qualcomm
    all versions

  • Qualcomm Qca6595au Firmware

    OS
    Qualcomm
    all versions

  • Qualcomm Qca6678aq

    HW
    Qualcomm
    all versions

  • Qualcomm Qca6678aq Firmware

    OS
    Qualcomm
    all versions

  • Qualcomm Qca6688aq

    HW
    Qualcomm
    all versions

  • Qualcomm Qca6688aq Firmware

    OS
    Qualcomm
    all versions

  • Qualcomm Qca6696

    HW
    Qualcomm
    all versions

  • Qualcomm Qca6696 Firmware

    OS
    Qualcomm
    all versions

  • Qualcomm Qca6698aq

    HW
    Qualcomm
    all versions

  • Qualcomm Qca6698aq Firmware

    OS
    Qualcomm
    all versions
🔵
CHECK WITH VENDOR
No clear patch data available. Check vendor references.
Tags
Auth Bypass
CWE
References

Related vulnerabilities

CVE-2026-25289CRITICAL9.6PL ✓same product

Przepełnienie bufora stosu w NAN Service Discovery Frames — Qualcomm

CVE-2025-47372CRITICAL9.0PL ✓same product

Qualcomm: Memory Corruption przy ładowaniu uszkodzonego obrazu ELF

CVE-2025-27034CRITICAL9.8PL ✓same product

Qualcomm Firmware — memory corruption przy wyborze PLMN z listy SOR

CVE-2025-21483CRITICAL9.8PL ✓same product

Memory corruption w Qualcomm podczas składania pakietów RTP (NALUs)

CVE-2024-45569CRITICAL9.8PL ✓same product

Qualcomm: Uszkodzenie pamięci przy parsowaniu ML IE w firmware