Technical impact
The vulnerability allows an attacker to gain unauthorized access to device configuration when the device is reset to factory defaults via the powerline interface. This information disclosure could reveal sensitive settings that might be used to compromise system integrity or facilitate further attacks. The weakness is classified as CWE‑1230, highlighting improper handling of configuration data during reset procedures.
Affected Systems
Qualcomm, Inc. Snapdragon powerline communication firmware. The entry does not specify version ranges, so all firmware builds that support factory reset over powerline may be affected until a patch is applied.
Risk and Exploitability
The CVSS score of 6.5 points to moderate risk. No EPSS score is available, and the vulnerability is not listed in CISA’s KEV catalog, indicating no publicly known exploitation yet. The likely attack vector involves an attacker with access to the powerline network or physical access to the device, potentially leveraging the reset capability to exfiltrate configuration data. Prompt remediation is advised as the disclosure could enable further compromise.
