Description
Exposed dangerous function lead to privilege escalation via gRPC server.
Published: 2026-09-22
Score: 8.8 High
EPSS: < 1% Very Low
KEV: No
Impact: Privilege Escalation
Action: Immediate Patch
AI Analysis

Impact

An exposed dangerous function in Qualcomm Package Manager and Qualcomm Software Center allows an attacker to gain higher privileges through the gRPC server component. The vulnerability is identified as CWE-749, a command injection type flaw that can be triggered via the exposed function.

Affected Systems

The affected products are Qualcomm’s Snapdragon software stack, specifically the Package Manager and Software Center components. No specific version details are provided in the current data.

Risk and Exploitability

The CVSS score of 8.8 indicates a high severity level, and the EPSS score is not available, while the vulnerability is not listed in the CISA KEV catalogue. Attackers would likely need network or local access to the gRPC interface; it is inferred that exploitation requires knowledge of the gRPC service and the vulnerable function’s parameters.

Generated by OpenCVE AI on September 22, 2026 at 12:25 UTC.

Remediation

No solution or workaround provided in the CVE record.

OpenCVE Recommended Actions

  • Apply the latest Qualcomm firmware or software patch that addresses the gRPC vulnerability in Package Manager and Software Center.
  • Restrict or disable the gRPC interface so that it is reachable only from trusted hosts or is turned off if not required for operations.
  • Enforce least‑privilege principles for the service accounts that run Package Manager and Software Center, ensuring that they cannot assume higher privileges through the exposed function.

Generated by OpenCVE AI on September 22, 2026 at 12:25 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Tue, 06 Oct 2026 15:45:00 +0000

Type Values Removed Values Added
First Time appeared Qualcomm package Manager
Qualcomm software Center
CPEs cpe:2.3:a:qualcomm:package_manager:3.0.125.4:*:*:*:*:*:*:*
cpe:2.3:a:qualcomm:package_manager:3.0.126.7:*:*:*:*:*:*:*
cpe:2.3:a:qualcomm:package_manager:3.0.127.2:*:*:*:*:*:*:*
cpe:2.3:a:qualcomm:software_center:1.17.1:*:*:*:*:*:*:*
cpe:2.3:a:qualcomm:software_center:1.19.1:*:*:*:*:*:*:*
cpe:2.3:a:qualcomm:software_center:1.21.0:*:*:*:*:*:*:*
Vendors & Products Qualcomm package Manager
Qualcomm software Center

Tue, 22 Sep 2026 12:15:00 +0000

Type Values Removed Values Added
First Time appeared Qualcomm
Qualcomm snapdragon
Vendors & Products Qualcomm
Qualcomm snapdragon

Tue, 22 Sep 2026 11:30:00 +0000

Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'total'}, 'version': '2.0.3'}

Tue, 22 Sep 2026 10:00:00 +0000

Type Values Removed Values Added
Description Exposed dangerous function lead to privilege escalation via gRPC server.
Title Exposed function in Qualcomm Package Manager and Qualcomm Software Center.
Weaknesses CWE-749
References
Metrics cvssV3_1

{'score': 8.8, 'vector': 'CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H'}

Subscriptions

Qualcomm Package Manager Snapdragon Software Center
cve-icon MITRE

Status: PUBLISHED

Assigner: qualcomm

Published:

Updated: 2026-09-22T10:15:28.059Z

Reserved: 2026-02-02T04:19:00.938Z

Link: CVE-2026-25255

cve-icon Vulnrichment

Updated: 2026-09-22T10:14:35.395Z

cve-icon NVD

Status : Analyzed

Published: 2026-09-22T10:17:08.847

Modified: 2026-10-06T15:34:46.513

Link: CVE-2026-25255

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-09-22T12:30:07Z

Weaknesses
  • CWE-749

    Exposed Dangerous Method or Function