CVE-2025-24857

Improper access control for volatile memory containing boot code in Universal Boot Loader (U-Boot) before 2017.11 and Qualcomm chips IPQ4019, IPQ5018, IPQ5322, IPQ6018, IPQ8064, IPQ8074, and IPQ9574 could allow an attacker to execute arbitrary code.

CVSS v3 7.6 HIGH

7.6^/10

CVSS v3 : HIGH

Vector :

Exploitability : 0.9 / Impact : 6.0

Attack Vector PHYSICAL

Attack Complexity LOW

Privileges Required NONE

User Interaction NONE

Confidentiality Impact HIGH

Integrity Impact HIGH

Availability Impact HIGH

Scope CHANGED

References

Link	Resource
https://www.cisa.gov/news-events/ics-advisories/icsa-25-343-01	Third Party Advisory US Government Resource

Configurations

Configuration 1 (hide)

AND

cpe:2.3:a:denx:u-boot:*:*:*:*:*:*:*:*

OR	cpe:2.3:h:qualcomm:ipq4019:-:::::::*
	cpe:2.3:h:qualcomm:ipq5018:-:::::::*
	cpe:2.3:h:qualcomm:ipq5322:-:::::::*
	cpe:2.3:h:qualcomm:ipq6018:-:::::::*
	cpe:2.3:h:qualcomm:ipq8064:-:::::::*
	cpe:2.3:h:qualcomm:ipq8074:-:::::::*
	cpe:2.3:h:qualcomm:ipq9574:-:::::::*

History

No history.

Information

Published : 2025-12-10 21:16

Updated : 2026-01-21 19:14

NVD link : CVE-2025-24857

Mitre link : CVE-2025-24857

CVE.ORG link : CVE-2025-24857

JSON object : View

Products Affected

qualcomm

ipq5018
ipq8064
ipq6018
ipq4019
ipq9574
ipq5322
ipq8074

denx

u-boot

CWE

CWE-284

Improper Access Control

{"id": "CVE-2025-24857", "cveTags": [], "metrics": {"cvssMetricV31": [{"type": "Secondary", "source": "cve@mitre.org", "cvssData": {"scope": "CHANGED", "version": "3.1", "baseScore": 7.6, "attackVector": "PHYSICAL", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:P/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "NONE", "confidentialityImpact": "HIGH"}, "impactScore": 6.0, "exploitabilityScore": 0.9}]}, "published": "2025-12-10T21:16:03.730", "references": [{"url": "https://www.cisa.gov/news-events/ics-advisories/icsa-25-343-01", "tags": ["Third Party Advisory", "US Government Resource"], "source": "cve@mitre.org"}], "vulnStatus": "Analyzed", "weaknesses": [{"type": "Secondary", "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "description": [{"lang": "en", "value": "CWE-284"}]}], "descriptions": [{"lang": "en", "value": "Improper access control for volatile memory containing boot code in Universal Boot Loader (U-Boot) before 2017.11 and Qualcomm chips IPQ4019, IPQ5018, IPQ5322, IPQ6018, IPQ8064, IPQ8074, and IPQ9574 could allow an attacker to execute arbitrary code."}], "lastModified": "2026-01-21T19:14:47.067", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:denx:u-boot:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "C4A006C7-7EDF-41A2-9679-24C6F423B9CD", "versionEndExcluding": "2017.11"}], "operator": "OR"}, {"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:h:qualcomm:ipq4019:-:*:*:*:*:*:*:*", "vulnerable": false, "matchCriteriaId": "AA679375-BB14-4B24-8AD9-B2BFBACE2FDB"}, {"criteria": "cpe:2.3:h:qualcomm:ipq5018:-:*:*:*:*:*:*:*", "vulnerable": false, "matchCriteriaId": "0E84640A-6848-4C76-96FC-EA349801D440"}, {"criteria": "cpe:2.3:h:qualcomm:ipq5322:-:*:*:*:*:*:*:*", "vulnerable": false, "matchCriteriaId": "0674C5CF-5F26-4FB6-9859-B9E730DA3CFC"}, {"criteria": "cpe:2.3:h:qualcomm:ipq6018:-:*:*:*:*:*:*:*", "vulnerable": false, "matchCriteriaId": "FDC1ADAD-DA77-47EF-8DB9-C36961C560C2"}, {"criteria": "cpe:2.3:h:qualcomm:ipq8064:-:*:*:*:*:*:*:*", "vulnerable": false, "matchCriteriaId": "AC82552A-9E7C-4A13-B7A5-43CEA218675C"}, {"criteria": "cpe:2.3:h:qualcomm:ipq8074:-:*:*:*:*:*:*:*", "vulnerable": false, "matchCriteriaId": "2118C404-402F-463C-8160-3CC3B703DF30"}, {"criteria": "cpe:2.3:h:qualcomm:ipq9574:-:*:*:*:*:*:*:*", "vulnerable": false, "matchCriteriaId": "0C866E83-23ED-495C-AA5A-0B01973674BF"}], "operator": "OR"}], "operator": "AND"}], "sourceIdentifier": "cve@mitre.org"}