CVE-2025-21425 - Vulnerability Details

Link	Providers
https://docs.qualcomm.com/product/publicresources/securitybulletin/april-2025-bulletin.html

Type	Values Removed	Values Added
Metrics		ssvc `{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'total'}, 'version': '2.0.3'}`

Type	Values Removed	Values Added
Description		Memory corruption may occur due top improper access control in HAB process.
Title		Improper Access Control in Automotive Linux OS
Weaknesses		CWE-284
References		https://docs.qualcomm.com/product/publicresources/securitybulletin/april-2025-bulletin.html
Metrics		cvssV3_1 `{'score': 7.3, 'vector': 'CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:L'}`

Show plain JSON

{"dataType": "CVE_RECORD", "dataVersion": "5.1", "cveMetadata": {"cveId": "CVE-2025-21425", "assignerOrgId": "2cfc7d3e-20d3-47ac-8db7-1b7285aff15f", "state": "PUBLISHED", "assignerShortName": "qualcomm", "dateReserved": "2024-12-18T09:50:08.918Z", "datePublished": "2025-04-07T10:15:53.976Z", "dateUpdated": "2025-04-08T03:56:08.790Z"}, "containers": {"cna": {"affected": [{"defaultStatus": "unaffected", "platforms": ["Snapdragon Auto"], "product": "Snapdragon", "vendor": "Qualcomm, Inc.", "versions": [{"status": "affected", "version": "QAM8255P"}, {"status": "affected", "version": "QAM8295P"}, {"status": "affected", "version": "QAM8620P"}, {"status": "affected", "version": "QAM8650P"}, {"status": "affected", "version": "QAM8775P"}, {"status": "affected", "version": "QAMSRV1H"}, {"status": "affected", "version": "QAMSRV1M"}, {"status": "affected", "version": "QCA6574AU"}, {"status": "affected", "version": "QCA6595"}, {"status": "affected", "version": "QCA6595AU"}, {"status": "affected", "version": "QCA6688AQ"}, {"status": "affected", "version": "QCA6696"}, {"status": "affected", "version": "QCA6698AQ"}, {"status": "affected", "version": "SA6145P"}, {"status": "affected", "version": "SA6150P"}, {"status": "affected", "version": "SA6155P"}, {"status": "affected", "version": "SA7255P"}, {"status": "affected", "version": "SA7775P"}, {"status": "affected", "version": "SA8145P"}, {"status": "affected", "version": "SA8150P"}, {"status": "affected", "version": "SA8155P"}, {"status": "affected", "version": "SA8195P"}, {"status": "affected", "version": "SA8255P"}, {"status": "affected", "version": "SA8295P"}, {"status": "affected", "version": "SA8540P"}, {"status": "affected", "version": "SA8620P"}, {"status": "affected", "version": "SA8650P"}, {"status": "affected", "version": "SA8770P"}, {"status": "affected", "version": "SA8775P"}, {"status": "affected", "version": "SA9000P"}, {"status": "affected", "version": "SRV1H"}, {"status": "affected", "version": "SRV1L"}, {"status": "affected", "version": "SRV1M"}]}], "descriptions": [{"lang": "en", "value": "Memory corruption may occur due top improper access control in HAB process."}], "metrics": [{"cvssV3_1": {"attackComplexity": "LOW", "attackVector": "LOCAL", "availabilityImpact": "LOW", "baseScore": 7.3, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:L", "version": "3.1"}, "format": "CVSS", "scenarios": [{"lang": "en", "value": "GENERAL"}]}], "problemTypes": [{"descriptions": [{"cweId": "CWE-284", "description": "CWE-284 Improper Access Control", "lang": "en", "type": "CWE"}]}], "providerMetadata": {"orgId": "2cfc7d3e-20d3-47ac-8db7-1b7285aff15f", "shortName": "qualcomm", "dateUpdated": "2025-04-07T10:15:53.976Z"}, "references": [{"url": "https://docs.qualcomm.com/product/publicresources/securitybulletin/april-2025-bulletin.html"}], "title": "Improper Access Control in Automotive Linux OS"}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2025-04-07T00:00:00+00:00", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "total"}], "role": "CISA Coordinator", "version": "2.0.3", "id": "CVE-2025-21425"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2025-04-08T03:56:08.790Z"}}]}}

{

dataType : CVE_RECORD (string)

dataVersion : 5.1 (string)

cveMetadata : { »

cveId : CVE-2025-21425 (string)

assignerOrgId : 2cfc7d3e-20d3-47ac-8db7-1b7285aff15f (string)

state : PUBLISHED (string)

assignerShortName : qualcomm (string)

dateReserved : 2024-12-18T09:50:08.918Z (string)

datePublished : 2025-04-07T10:15:53.976Z (string)

dateUpdated : 2025-04-08T03:56:08.790Z (string)

}

containers : { »

cna : { »

affected : [ »

0 : { »

defaultStatus : unaffected (string)

platforms : [ »

0 : Snapdragon Auto (string)

]

product : Snapdragon (string)

vendor : Qualcomm, Inc. (string)

versions : [ »

0 : { »

status : affected (string)

version : QAM8255P (string)

}

1 : { »

status : affected (string)

version : QAM8295P (string)

}

2 : { »

status : affected (string)

version : QAM8620P (string)

}

3 : { »

status : affected (string)

version : QAM8650P (string)

}

4 : { »

status : affected (string)

version : QAM8775P (string)

}

5 : { »

status : affected (string)

version : QAMSRV1H (string)

}

6 : { »

status : affected (string)

version : QAMSRV1M (string)

}

7 : { »

status : affected (string)

version : QCA6574AU (string)

}

8 : { »

status : affected (string)

version : QCA6595 (string)

}

9 : { »

status : affected (string)

version : QCA6595AU (string)

}

10 : { »

status : affected (string)

version : QCA6688AQ (string)

}

11 : { »

status : affected (string)

version : QCA6696 (string)

}

12 : { »

status : affected (string)

version : QCA6698AQ (string)

}

13 : { »

status : affected (string)

version : SA6145P (string)

}

14 : { »

status : affected (string)

version : SA6150P (string)

}

15 : { »

status : affected (string)

version : SA6155P (string)

}

16 : { »

status : affected (string)

version : SA7255P (string)

}

17 : { »

status : affected (string)

version : SA7775P (string)

}

18 : { »

status : affected (string)

version : SA8145P (string)

}

19 : { »

status : affected (string)

version : SA8150P (string)

}

20 : { »

status : affected (string)

version : SA8155P (string)

}

21 : { »

status : affected (string)

version : SA8195P (string)

}

22 : { »

status : affected (string)

version : SA8255P (string)

}

23 : { »

status : affected (string)

version : SA8295P (string)

}

24 : { »

status : affected (string)

version : SA8540P (string)

}

25 : { »

status : affected (string)

version : SA8620P (string)

}

26 : { »

status : affected (string)

version : SA8650P (string)

}

27 : { »

status : affected (string)

version : SA8770P (string)

}

28 : { »

status : affected (string)

version : SA8775P (string)

}

29 : { »

status : affected (string)

version : SA9000P (string)

}

30 : { »

status : affected (string)

version : SRV1H (string)

}

31 : { »

status : affected (string)

version : SRV1L (string)

}

32 : { »

status : affected (string)

version : SRV1M (string)

}

]

}

]

descriptions : [ »

0 : { »

lang : en (string)

value : Memory corruption may occur due top improper access control in HAB process. (string)

}

]

metrics : [ »

0 : { »

cvssV3_1 : { »

attackComplexity : LOW (string)

attackVector : LOCAL (string)

availabilityImpact : LOW (string)

baseScore : 7.3 (number)

baseSeverity : HIGH (string)

confidentialityImpact : HIGH (string)

integrityImpact : HIGH (string)

privilegesRequired : LOW (string)

scope : UNCHANGED (string)

userInteraction : NONE (string)

vectorString : CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:L (string)

version : 3.1 (string)

}

format : CVSS (string)

scenarios : [ »

0 : { »

lang : en (string)

value : GENERAL (string)

}

]

}

]

problemTypes : [ »

0 : { »

descriptions : [ »

0 : { »

cweId : CWE-284 (string)

description : CWE-284 Improper Access Control (string)

lang : en (string)

type : CWE (string)

}

]

}

]

providerMetadata : { »

orgId : 2cfc7d3e-20d3-47ac-8db7-1b7285aff15f (string)

shortName : qualcomm (string)

dateUpdated : 2025-04-07T10:15:53.976Z (string)

}

references : [ »

0 : { »

url : https://docs.qualcomm.com/product/publicresources/securitybulletin/april-2025-bulletin.html (string)

}

]

title : Improper Access Control in Automotive Linux OS (string)

}

adp : [ »

0 : { »

metrics : [ »

0 : { »

other : { »

type : ssvc (string)

content : { »

timestamp : 2025-04-07T00:00:00+00:00 (string)

options : [ »

0 : { »

Exploitation : none (string)

}

1 : { »

Automatable : no (string)

}

2 : { »

Technical Impact : total (string)

}

]

role : CISA Coordinator (string)

version : 2.0.3 (string)

id : CVE-2025-21425 (string)

}

]

title : CISA ADP Vulnrichment (string)

providerMetadata : { »

orgId : 134c704f-9b21-4f2e-91b3-4a467353bcc0 (string)

shortName : CISA-ADP (string)

dateUpdated : 2025-04-08T03:56:08.790Z (string)

}

]

}

Show plain JSON

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2025-21425", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "total"}], "version": "2.0.3", "timestamp": "2025-04-07T14:55:20.616003Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2025-04-07T14:55:27.644Z"}}], "cna": {"title": "Improper Access Control in Automotive Linux OS", "metrics": [{"format": "CVSS", "cvssV3_1": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 7.3, "attackVector": "LOCAL", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:L", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "LOW", "privilegesRequired": "LOW", "confidentialityImpact": "HIGH"}, "scenarios": [{"lang": "en", "value": "GENERAL"}]}], "affected": [{"vendor": "Qualcomm, Inc.", "product": "Snapdragon", "versions": [{"status": "affected", "version": "QAM8255P"}, {"status": "affected", "version": "QAM8295P"}, {"status": "affected", "version": "QAM8620P"}, {"status": "affected", "version": "QAM8650P"}, {"status": "affected", "version": "QAM8775P"}, {"status": "affected", "version": "QAMSRV1H"}, {"status": "affected", "version": "QAMSRV1M"}, {"status": "affected", "version": "QCA6574AU"}, {"status": "affected", "version": "QCA6595"}, {"status": "affected", "version": "QCA6595AU"}, {"status": "affected", "version": "QCA6688AQ"}, {"status": "affected", "version": "QCA6696"}, {"status": "affected", "version": "QCA6698AQ"}, {"status": "affected", "version": "SA6145P"}, {"status": "affected", "version": "SA6150P"}, {"status": "affected", "version": "SA6155P"}, {"status": "affected", "version": "SA7255P"}, {"status": "affected", "version": "SA7775P"}, {"status": "affected", "version": "SA8145P"}, {"status": "affected", "version": "SA8150P"}, {"status": "affected", "version": "SA8155P"}, {"status": "affected", "version": "SA8195P"}, {"status": "affected", "version": "SA8255P"}, {"status": "affected", "version": "SA8295P"}, {"status": "affected", "version": "SA8540P"}, {"status": "affected", "version": "SA8620P"}, {"status": "affected", "version": "SA8650P"}, {"status": "affected", "version": "SA8770P"}, {"status": "affected", "version": "SA8775P"}, {"status": "affected", "version": "SA9000P"}, {"status": "affected", "version": "SRV1H"}, {"status": "affected", "version": "SRV1L"}, {"status": "affected", "version": "SRV1M"}], "platforms": ["Snapdragon Auto"], "defaultStatus": "unaffected"}], "references": [{"url": "https://docs.qualcomm.com/product/publicresources/securitybulletin/april-2025-bulletin.html"}], "descriptions": [{"lang": "en", "value": "Memory corruption may occur due top improper access control in HAB process."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-284", "description": "CWE-284 Improper Access Control"}]}], "providerMetadata": {"orgId": "2cfc7d3e-20d3-47ac-8db7-1b7285aff15f", "shortName": "qualcomm", "dateUpdated": "2025-04-07T10:15:53.976Z"}}}, "cveMetadata": {"cveId": "CVE-2025-21425", "state": "PUBLISHED", "dateUpdated": "2025-04-08T03:56:08.790Z", "dateReserved": "2024-12-18T09:50:08.918Z", "assignerOrgId": "2cfc7d3e-20d3-47ac-8db7-1b7285aff15f", "datePublished": "2025-04-07T10:15:53.976Z", "assignerShortName": "qualcomm"}, "dataVersion": "5.1"}

{

dataType : CVE_RECORD (string)

containers : { »

adp : [ »

0 : { »

title : CISA ADP Vulnrichment (string)

metrics : [ »

0 : { »

other : { »

type : ssvc (string)

content : { »

id : CVE-2025-21425 (string)

role : CISA Coordinator (string)

options : [ »

0 : { »

Exploitation : none (string)

}

1 : { »

Automatable : no (string)

}

2 : { »

Technical Impact : total (string)

}

]

version : 2.0.3 (string)

timestamp : 2025-04-07T14:55:20.616003Z (string)

}

]

providerMetadata : { »

orgId : 134c704f-9b21-4f2e-91b3-4a467353bcc0 (string)

shortName : CISA-ADP (string)

dateUpdated : 2025-04-07T14:55:27.644Z (string)

}

]

cna : { »

title : Improper Access Control in Automotive Linux OS (string)

metrics : [ »

0 : { »

format : CVSS (string)

cvssV3_1 : { »

scope : UNCHANGED (string)

version : 3.1 (string)

baseScore : 7.3 (number)

attackVector : LOCAL (string)

baseSeverity : HIGH (string)

vectorString : CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:L (string)

integrityImpact : HIGH (string)

userInteraction : NONE (string)

attackComplexity : LOW (string)

availabilityImpact : LOW (string)

privilegesRequired : LOW (string)

confidentialityImpact : HIGH (string)

}

scenarios : [ »

0 : { »

lang : en (string)

value : GENERAL (string)

}

]

}

]

affected : [ »

0 : { »

vendor : Qualcomm, Inc. (string)

product : Snapdragon (string)

versions : [ »

0 : { »

status : affected (string)

version : QAM8255P (string)

}

1 : { »

status : affected (string)

version : QAM8295P (string)

}

2 : { »

status : affected (string)

version : QAM8620P (string)

}

3 : { »

status : affected (string)

version : QAM8650P (string)

}

4 : { »

status : affected (string)

version : QAM8775P (string)

}

5 : { »

status : affected (string)

version : QAMSRV1H (string)

}

6 : { »

status : affected (string)

version : QAMSRV1M (string)

}

7 : { »

status : affected (string)

version : QCA6574AU (string)

}

8 : { »

status : affected (string)

version : QCA6595 (string)

}

9 : { »

status : affected (string)

version : QCA6595AU (string)

}

10 : { »

status : affected (string)

version : QCA6688AQ (string)

}

11 : { »

status : affected (string)

version : QCA6696 (string)

}

12 : { »

status : affected (string)

version : QCA6698AQ (string)

}

13 : { »

status : affected (string)

version : SA6145P (string)

}

14 : { »

status : affected (string)

version : SA6150P (string)

}

15 : { »

status : affected (string)

version : SA6155P (string)

}

16 : { »

status : affected (string)

version : SA7255P (string)

}

17 : { »

status : affected (string)

version : SA7775P (string)

}

18 : { »

status : affected (string)

version : SA8145P (string)

}

19 : { »

status : affected (string)

version : SA8150P (string)

}

20 : { »

status : affected (string)

version : SA8155P (string)

}

21 : { »

status : affected (string)

version : SA8195P (string)

}

22 : { »

status : affected (string)

version : SA8255P (string)

}

23 : { »

status : affected (string)

version : SA8295P (string)

}

24 : { »

status : affected (string)

version : SA8540P (string)

}

25 : { »

status : affected (string)

version : SA8620P (string)

}

26 : { »

status : affected (string)

version : SA8650P (string)

}

27 : { »

status : affected (string)

version : SA8770P (string)

}

28 : { »

status : affected (string)

version : SA8775P (string)

}

29 : { »

status : affected (string)

version : SA9000P (string)

}

30 : { »

status : affected (string)

version : SRV1H (string)

}

31 : { »

status : affected (string)

version : SRV1L (string)

}

32 : { »

status : affected (string)

version : SRV1M (string)

}

]

platforms : [ »

0 : Snapdragon Auto (string)

]

defaultStatus : unaffected (string)

}

]

references : [ »

0 : { »

url : https://docs.qualcomm.com/product/publicresources/securitybulletin/april-2025-bulletin.html (string)

}

]

descriptions : [ »

0 : { »

lang : en (string)

value : Memory corruption may occur due top improper access control in HAB process. (string)

}

]

problemTypes : [ »

0 : { »

descriptions : [ »

0 : { »

lang : en (string)

type : CWE (string)

cweId : CWE-284 (string)

description : CWE-284 Improper Access Control (string)

}

]

}

]

providerMetadata : { »

orgId : 2cfc7d3e-20d3-47ac-8db7-1b7285aff15f (string)

shortName : qualcomm (string)

dateUpdated : 2025-04-07T10:15:53.976Z (string)

}

cveMetadata : { »

cveId : CVE-2025-21425 (string)

state : PUBLISHED (string)

dateUpdated : 2025-04-08T03:56:08.790Z (string)

dateReserved : 2024-12-18T09:50:08.918Z (string)

assignerOrgId : 2cfc7d3e-20d3-47ac-8db7-1b7285aff15f (string)

datePublished : 2025-04-07T10:15:53.976Z (string)

assignerShortName : qualcomm (string)

}

dataVersion : 5.1 (string)

}

Show plain JSON

{"cveTags": [], "descriptions": [{"lang": "en", "value": "Memory corruption may occur due top improper access control in HAB process."}], "id": "CVE-2025-21425", "lastModified": "2025-04-07T14:17:50.220", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "LOCAL", "availabilityImpact": "LOW", "baseScore": 7.3, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:L", "version": "3.1"}, "exploitabilityScore": 1.8, "impactScore": 5.5, "source": "product-security@qualcomm.com", "type": "Primary"}]}, "published": "2025-04-07T11:15:50.697", "references": [{"source": "product-security@qualcomm.com", "url": "https://docs.qualcomm.com/product/publicresources/securitybulletin/april-2025-bulletin.html"}], "sourceIdentifier": "product-security@qualcomm.com", "vulnStatus": "Awaiting Analysis", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-284"}], "source": "product-security@qualcomm.com", "type": "Primary"}]}

{

cveTags : [ *empty* ]

descriptions : [ »

0 : { »

lang : en (string)

value : Memory corruption may occur due top improper access control in HAB process. (string)

}

]

id : CVE-2025-21425 (string)

lastModified : 2025-04-07T14:17:50.220 (string)

metrics : { »

cvssMetricV31 : [ »

0 : { »

cvssData : { »

attackComplexity : LOW (string)

attackVector : LOCAL (string)

availabilityImpact : LOW (string)

baseScore : 7.3 (number)

baseSeverity : HIGH (string)

confidentialityImpact : HIGH (string)

integrityImpact : HIGH (string)

privilegesRequired : LOW (string)

scope : UNCHANGED (string)

userInteraction : NONE (string)

vectorString : CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:L (string)

version : 3.1 (string)

}

exploitabilityScore : 1.8 (number)

impactScore : 5.5 (number)

source : product-security@qualcomm.com (string)

type : Primary (string)

}

]

}

published : 2025-04-07T11:15:50.697 (string)

references : [ »

0 : { »

source : product-security@qualcomm.com (string)

url : https://docs.qualcomm.com/product/publicresources/securitybulletin/april-2025-bulletin.html (string)

}

]

sourceIdentifier : product-security@qualcomm.com (string)

vulnStatus : Awaiting Analysis (string)

weaknesses : [ »

0 : { »

description : [ »

0 : { »

lang : en (string)

value : CWE-284 (string)

}

]

source : product-security@qualcomm.com (string)

type : Primary (string)

}

]

}

Metrics

Attack Vector Local

Attack Complexity Low

Privileges Required Low

Scope Unchanged

Confidentiality Impact High

Integrity Impact High

Availability Impact Low

User Interaction None

Exploitation none

Automatable no

Technical Impact total

Affected Vendors & Products

Metrics

Attack Vector Local

Attack Complexity Low

Privileges Required Low

Scope Unchanged

Confidentiality Impact High

Integrity Impact High

Availability Impact Low

User Interaction None

Exploitation none

Automatable no

Technical Impact total

Affected Vendors & Products

JSON object

JSON object

JSON object

JSON object