deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2025-1814
Published: 2025-03-02
Description: A vulnerability, which was classified as critical, has been found in Tenda AC6 15.03.05.16. Affected by this issue is some unknown functionality of the file /goform/WifiExtraSet. The manipulation of the argument wpapsk_crypto leads to stack-based buffer overflow. The attack may be launched remotely. The exploit has been disclosed to the public and may be used.
CVSS Score: 8.8 (HIGH)
CWE: CWE-119, CWE-121, CWE-787
References: https://github.com/Raining-101/IOT_cve/blob/main/ac6.md_goform_WifiExtraSet.md; https://vuldb.com/?ctiid.298082; https://vuldb.com/?id.298082
CVE: CVE-2025-1815
Published: 2025-03-02
Description: A vulnerability, which was classified as critical, was found in pbrong hrms up to 1.0.1. This affects the function HrmsDB of the file \resource\resource.go. The manipulation of the argument user_cookie leads to improper authorization. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used.
CVSS Score: 7.3 (HIGH)
CWE: CWE-266, CWE-285
References: https://github.com/A7cc/cve/issues/4; https://github.com/A7cc/cve/issues/4#issue[PII_REDACTED]; https://vuldb.com/?ctiid.298083
CVE: CVE-2025-1816
Published: 2025-03-02
Description: A vulnerability classified as problematic has been found in FFmpeg up to 6e26f57f672b05e7b8b052007a83aef99dc81ccb. This affects the function audio_element_obu of the file libavformat/iamf_parse.c of the component IAMF File Handler. The manipulation of the argument num_parameters leads to memory leak. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used. The identifier of the patch is 0526535cd58444dd264e810b2f3348b4d96cff3b. It is recommended to apply a patch to fix this issue.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-401, CWE-404
References: https://ffmpeg.org/; https://git.ffmpeg.org/gitweb/ffmpeg.git/commit/0526535cd58444dd264e810b2f3348b4d96cff3b; https://trac.ffmpeg.org/attachment/ticket/11475/poc
CVE: CVE-2022-49733
Published: 2025-03-02
Description: In the Linux kernel, the following vulnerability has been resolved:

ALSA: pcm: oss: Fix race at SNDCTL_DSP_SYNC

There is a small race window at snd_pcm_oss_sync() that is called from
OSS PCM SNDCTL_DSP_SYNC ioctl; namely the function calls
snd_pcm_oss_make_ready() at first, then takes the params_lock mutex
for the rest.  When the stream is set up again by another thread
between them, it leads to inconsistency, and may result in unexpected
results such as NULL dereference of OSS buffer as a fuzzer spotted
recently.

The fix is simply to cover snd_pcm_oss_make_ready() call into the same
params_lock mutex with snd_pcm_oss_make_ready_locked() variant.
CVSS Score: 4.7 (MEDIUM)
CWE: CWE-362, CWE-476, CWE-476
References: https://git.kernel.org/stable/c/4051324a6dafd7053c74c475e80b3ba10ae672b0; https://git.kernel.org/stable/c/723ac5ab2891b6c10dd6cc78ef5456af593490eb; https://git.kernel.org/stable/c/8015ef9e8a0ee5cecfd0cb6805834d007ab26f86
CVE: CVE-2025-1817
Published: 2025-03-02
Description: A vulnerability classified as problematic was found in Mini-Tmall up to 20250211. This vulnerability affects unknown code of the file /admin of the component Admin Name Handler. The manipulation leads to cross site scripting. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used.
CVSS Score: 2.4 (LOW)
CWE: CWE-79, CWE-94, CWE-79
References: https://github.com/qkdjksfkeg/cve_article/blob/main/Tmall_demo/XSS.md; https://vuldb.com/?ctiid.298090; https://vuldb.com/?id.298090
CVE: CVE-2024-55907
Published: 2025-03-02
Description: IBM Cognos Analytics Mobile 1.1 for iOS application could allow an attacker to reverse engineer the codebase to gain knowledge about the programming technique, interface, class definitions, algorithms and functions used due to weak obfuscation.
CVSS Score: 2.0 (LOW)
CWE: CWE-540
References: https://www.ibm.com/support/pages/node/7184429
CVE: CVE-2025-0895
Published: 2025-03-02
Description: IBM Cognos Analytics Mobile 1.1 for Android could allow a user with physical access to the device, to obtain sensitive information from debugging code log messages.
CVSS Score: 2.4 (LOW)
CWE: CWE-215
References: https://www.ibm.com/support/pages/node/7184430
CVE: CVE-2025-1818
Published: 2025-03-02
Description: A vulnerability, which was classified as critical, has been found in zj1983 zz up to 2024-8. This issue affects some unknown processing of the file src/main/java/com/futvan/z/system/zfile/ZfileAction.upload. The manipulation of the argument file leads to unrestricted upload. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.
CVSS Score: 6.3 (MEDIUM)
CWE: CWE-284, CWE-434, CWE-434
References: https://vuldb.com/?ctiid.298091; https://vuldb.com/?id.298091; https://vuldb.com/?submit.504304
CVE: CVE-2025-1819
Published: 2025-03-02
Description: A vulnerability, which was classified as critical, was found in Tenda AC7 1200M 15.03.06.44. Affected is the function TendaTelnet of the file /goform/telnet. The manipulation of the argument lan_ip leads to os command injection. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used.
CVSS Score: 6.3 (MEDIUM)
CWE: CWE-77, CWE-78, CWE-78
References: https://github.com/Raining-101/IOT_cve/blob/main/Tenda%20a7%20V15.03.06.44%20Command%20injection.md; https://vuldb.com/?ctiid.298092; https://vuldb.com/?id.298092
CVE: CVE-2025-1820
Published: 2025-03-02
Description: A vulnerability has been found in zj1983 zz up to 2024-8 and classified as critical. Affected by this vulnerability is the function getOaWid of the file src/main/java/com/futvan/z/system/zworkflow/ZworkflowAction.java. The manipulation of the argument tableId leads to sql injection. The attack can be launched remotely. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.
CVSS Score: 6.3 (MEDIUM)
CWE: CWE-74, CWE-89, CWE-89
References: https://github.com/caigo8/CVE-md/blob/main/zz/zz_2024_8_SQL%E6%B3%A8%E5%85%A51.md; https://vuldb.com/?ctiid.298093; https://vuldb.com/?id.298093
CVE: CVE-2024-36353
Published: 2025-03-02
Description: Insufficient clearing of GPU global memory could allow a malicious process running on the same GPU to read left over memory values potentially leading to loss of confidentiality.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-459
References: https://www.amd.com/en/resources/product-security/bulletin/AMD-SB-6019.html
CVE: CVE-2025-1821
Published: 2025-03-02
Description: A vulnerability was found in zj1983 zz up to 2024-8 and classified as critical. Affected by this issue is the function getUserOrgForUserId of the file src/main/java/com/futvan/z/system/zorg/ZorgAction.java. The manipulation of the argument userID leads to sql injection. The attack may be launched remotely. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.
CVSS Score: 6.3 (MEDIUM)
CWE: CWE-74, CWE-89, CWE-89
References: https://github.com/caigo8/CVE-md/blob/main/zz/ZZ_2024_8%E5%89%8D%E5%8F%B0SQL%E6%B3%A8%E5%85%A5.md; https://vuldb.com/?ctiid.298094; https://vuldb.com/?id.298094
CVE: CVE-2025-1829
Published: 2025-03-02
Description: A vulnerability was found in TOTOLINK X18 9.1.0cu.2024_B20220329. It has been declared as critical. This vulnerability affects the function setMtknatCfg of the file /cgi-bin/cstecgi.cgi. The manipulation of the argument mtkhnatEnable leads to os command injection. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.
CVSS Score: 6.3 (MEDIUM)
CWE: CWE-77, CWE-78, CWE-78
References: https://github.com/sjwszt/CVE/blob/main/CVE_2.md; https://vuldb.com/?ctiid.298096; https://vuldb.com/?id.298096
CVE: CVE-2025-1830
Published: 2025-03-02
Description: A vulnerability was found in zj1983 zz up to 2024-8. It has been rated as problematic. This issue affects some unknown processing of the component Customer Information Handler. The manipulation of the argument Customer Name leads to cross site scripting. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.
CVSS Score: 2.4 (LOW)
CWE: CWE-79, CWE-94, CWE-79
References: https://github.com/caigo8/CVE-md/blob/main/zz/zz_xss1.md; https://vuldb.com/?ctiid.298097; https://vuldb.com/?id.298097
CVE: CVE-2025-1831
Published: 2025-03-02
Description: A vulnerability classified as critical has been found in zj1983 zz up to 2024-8. Affected is the function GetDBUser of the file src/main/java/com/futvan/z/system/zorg/ZorgAction.java. The manipulation of the argument user_id leads to sql injection. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.
CVSS Score: 6.3 (MEDIUM)
CWE: CWE-74, CWE-89, CWE-89
References: https://github.com/caigo8/CVE-md/blob/main/zz/ZZ_2024_8%E5%89%8D%E5%8F%B0SQL%E6%B3%A8%E5%85%A52.md; https://vuldb.com/?ctiid.298098; https://vuldb.com/?id.298098
CVE: CVE-2025-1832
Published: 2025-03-02
Description: A vulnerability classified as critical was found in zj1983 zz up to 2024-8. Affected by this vulnerability is the function getUserList of the file src/main/java/com/futvan/z/system/zrole/ZroleAction.java. The manipulation of the argument roleid leads to sql injection. The attack can be launched remotely. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.
CVSS Score: 6.3 (MEDIUM)
CWE: CWE-74, CWE-89, CWE-89
References: https://github.com/caigo8/CVE-md/blob/main/zz/zz_2024_8_4%E5%90%8E%E5%8F%B0SQL%E6%B3%A8%E5%85%A5.md; https://vuldb.com/?ctiid.298099; https://vuldb.com/?id.298099
CVE: CVE-2025-1833
Published: 2025-03-02
Description: A vulnerability, which was classified as critical, has been found in zj1983 zz up to 2024-8. Affected by this issue is the function sendNotice of the file src/main/java/com/futvan/z/erp/customer_notice/Customer_noticeAction.java of the component HTTP Request Handler. The manipulation of the argument url leads to server-side request forgery. The attack may be launched remotely. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.
CVSS Score: 6.3 (MEDIUM)
CWE: CWE-918
References: https://github.com/caigo8/CVE-md/blob/main/zz/zz_2024_8%E5%90%8E%E5%8F%B0SSRF.md; https://vuldb.com/?ctiid.298100; https://vuldb.com/?id.298100
CVE: CVE-2025-1834
Published: 2025-03-02
Description: A vulnerability, which was classified as critical, was found in zj1983 zz up to 2024-8. This affects an unknown part of the file /resolve. The manipulation of the argument file leads to unrestricted upload. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.
CVSS Score: 6.3 (MEDIUM)
CWE: CWE-284, CWE-434, CWE-434
References: https://github.com/caigo8/CVE-md/blob/main/zz/zz_resolve%E6%8E%A5%E5%8F%A3%E4%BB%BB%E6%84%8F%E6%96%87%E4%BB%B6%E4%B8%8A%E4%BC%A0.md; https://vuldb.com/?ctiid.298101; https://vuldb.com/?id.298101
CVE: CVE-2025-1835
Published: 2025-03-02
Description: A vulnerability has been found in osuuu LightPicture 1.2.2 and classified as critical. This vulnerability affects the function upload of the file /app/controller/Api.php. The manipulation of the argument file leads to unrestricted upload. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used.
CVSS Score: 6.3 (MEDIUM)
CWE: CWE-284, CWE-434
References: https://github.com/sheratan4/cve/issues/1; https://vuldb.com/?ctiid.298102; https://vuldb.com/?id.298102
CVE: CVE-2025-1836
Published: 2025-03-02
Description: A vulnerability was found in Incorta 2023.4.3. It has been classified as problematic. Affected is an unknown function of the component Edit Insight Handler. The manipulation of the argument Service Name leads to csv injection. It is possible to launch the attack remotely. The vendor was contacted early about this disclosure but did not respond in any way.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-74, CWE-1236
References: https://vuldb.com/?ctiid.298104; https://vuldb.com/?id.298104; https://vuldb.com/?submit.503070
CVE: CVE-2025-1840
Published: 2025-03-03
Description: A vulnerability was found in ESAFENET CDG 5.6.3.154.205. It has been rated as critical. Affected by this issue is some unknown functionality of the file /CDGServer3/workflowE/useractivate/updateorg.jsp. The manipulation of the argument flowId leads to sql injection. The attack may be launched remotely. The exploit has been disclosed to the public and may be used.
CVSS Score: 7.3 (HIGH)
CWE: CWE-74, CWE-89, CWE-89
References: https://github.com/Rain1er/report/blob/main/CDG/dXBkYXRlb3JnLmpzcA%3D%3D.md; https://vuldb.com/?ctiid.298106; https://vuldb.com/?id.298106
CVE: CVE-2025-1841
Published: 2025-03-03
Description: A vulnerability classified as critical has been found in ESAFENET CDG 5.6.3.154.205. This affects an unknown part of the file /CDGServer3/logManagement/ClientSortLog.jsp. The manipulation of the argument startDate/endDate leads to sql injection. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used.
CVSS Score: 7.3 (HIGH)
CWE: CWE-74, CWE-89, CWE-89
References: https://github.com/Rain1er/report/blob/main/CDG/Q2xpZW50U29ydExvZy5qc3A%3D.md; https://vuldb.com/?ctiid.298107; https://vuldb.com/?id.298107
CVE: CVE-2025-27579
Published: 2025-03-03
Description: In Bitaxe ESP-Miner before 2.5.0 with AxeOS, one can use an /api/system CSRF attack to update the payout address (aka stratumUser) for a Bitaxe Bitcoin miner, or change the frequency and voltage settings.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-352
References: https://github.com/skot/ESP-Miner/pull/637; https://snotra.uk/axeos-csrf-vulnerability.html; https://www.nobsbitcoin.com/bitaxe-firmware-esp-miner-v2-5-0/
CVE: CVE-2025-1842
Published: 2025-03-03
Description: A vulnerability classified as problematic was found in FITSTATS Technologies AthleteMonitoring up to 20250302. This vulnerability affects unknown code of the file /login.php. The manipulation of the argument username leads to cross site scripting. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79, CWE-94
References: https://vuldb.com/?ctiid.298108; https://vuldb.com/?id.298108; https://vuldb.com/?submit.504603
CVE: CVE-2025-1843
Published: 2025-03-03
Description: A vulnerability, which was classified as critical, has been found in Mini-Tmall up to 20250211. This issue affects the function select of the file com/xq/tmall/dao/ProductMapper.java. The manipulation of the argument orderBy leads to sql injection. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.
CVSS Score: 6.3 (MEDIUM)
CWE: CWE-74, CWE-89, CWE-89
References: https://github.com/qkdjksfkeg/cve_article/blob/main/Tmall_demo/SQL%20injection.md; https://vuldb.com/?ctiid.298109; https://vuldb.com/?id.298109
CVE: CVE-2025-25948
Published: 2025-03-03
Description: Incorrect access control in the component /rest/staffResource/create of Serosoft Solutions Pvt Ltd Academia Student Information System (SIS) EagleR v1.0.118 allows create and modify user accounts, including an Administrator account.
CVSS Score: 9.1 (CRITICAL)
CWE: CWE-284
References: https://github.com/VvV1per/Vulnerability-Research-CVEs/tree/main/CVE-2024-53637; https://github.com/VvV1per/Vulnerability-Research-CVEs/tree/main/CVE-2025-25948; https://github.com/el-viper/cve-research/tree/main/CVEs/CVE-2025-25948
CVE: CVE-2025-25949
Published: 2025-03-03
Description: A stored cross-site scripting (XSS) vulnerability in Serosoft Solutions Pvt Ltd Academia Student Information System (SIS) EagleR v1.0.118 allows attackers to execute arbitrary web scripts or HTML via injecting a crafted payload into the User ID parameter at /rest/staffResource/update.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79
References: https://github.com/VvV1per/Vulnerability-Research-CVEs/tree/main/CVE-2024-89636; https://github.com/VvV1per/Vulnerability-Research-CVEs/tree/main/CVE-2025-25949; https://github.com/el-viper/cve-research/tree/main/CVEs/CVE-2025-25949
CVE: CVE-2025-25950
Published: 2025-03-03
Description: Incorrect access control in the component /rest/staffResource/update of Serosoft Solutions Pvt Ltd Academia Student Information System (SIS) EagleR v1.0.118 allows create and modify user accounts, including an Administrator account.
CVSS Score: 8.1 (HIGH)
CWE: CWE-284
References: https://github.com/VvV1per/Vulnerability-Research-CVEs/tree/main/CVE-2024-89637; https://github.com/VvV1per/Vulnerability-Research-CVEs/tree/main/CVE-2025-25950; https://github.com/el-viper/cve-research/tree/main/CVEs/CVE-2025-25950
CVE: CVE-2025-25951
Published: 2025-03-03
Description: An information disclosure vulnerability in the component /rest/cb/executeBasicSearch of Serosoft Solutions Pvt Ltd Academia Student Information System (SIS) EagleR v1.0.118 allows attackers to access sensitive user information.
CVSS Score: 7.5 (HIGH)
CWE: CWE-200
References: https://github.com/VvV1per/Vulnerability-Research-CVEs/tree/main/CVE-2024-89638; https://github.com/VvV1per/Vulnerability-Research-CVEs/tree/main/CVE-2025-25951; https://github.com/el-viper/cve-research/tree/main/CVEs/CVE-2025-25951
CVE: CVE-2025-25952
Published: 2025-03-03
Description: An Insecure Direct Object References (IDOR) in the component /getStudemtAllDetailsById?studentId=XX of Serosoft Solutions Pvt Ltd Academia Student Information System (SIS) EagleR v1.0.118 allows attackers to access sensitive user information via a crafted API request.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-639
References: https://github.com/VvV1per/Vulnerability-Research-CVEs/tree/main/CVE-2024-89639; https://github.com/VvV1per/Vulnerability-Research-CVEs/tree/main/CVE-2025-25952; https://github.com/el-viper/cve-research/tree/main/CVEs/CVE-2025-25952
CVE: CVE-2025-25953
Published: 2025-03-03
Description: Serosoft Solutions Pvt Ltd Academia Student Information System (SIS) EagleR v1.0.118 was discovered to contain an Azure JWT access token exposure. This vulnerability allows authenticated attackers to escalate privileges and access sensitive information.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-862
References: https://github.com/VvV1per/Vulnerability-Research-CVEs/tree/main/CVE-2024-89640; https://github.com/VvV1per/Vulnerability-Research-CVEs/tree/main/CVE-2025-25953; https://github.com/el-viper/cve-research/tree/main/CVEs/CVE-2025-25953
CVE: CVE-2025-27583
Published: 2025-03-03
Description: Incorrect access control in the component /rest/staffResource/findAllUsersAcrossOrg of Serosoft Solutions Pvt Ltd Academia Student Information System (SIS) EagleR v1.0.118 allows create and modify user accounts, including an Administrator account.
CVSS Score: 9.1 (CRITICAL)
CWE: CWE-862
References: https://github.com/VvV1per/Vulnerability-Research-CVEs/tree/main/CVE-2024-53637
CVE: CVE-2025-27584
Published: 2025-03-03
Description: A stored cross-site scripting (XSS) vulnerability in Serosoft Solutions Pvt Ltd Academia Student Information System (SIS) EagleR v1.0.118 allows attackers to execute arbitrary web scripts or HTML via injecting a crafted payload into the First Name parameter at /rest/staffResource/update.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79
References: https://github.com/VvV1per/Vulnerability-Research-CVEs/tree/main/CVE-2024-89636
CVE: CVE-2025-27585
Published: 2025-03-03
Description: A stored cross-site scripting (XSS) vulnerability in Serosoft Solutions Pvt Ltd Academia Student Information System (SIS) EagleR v1.0.118 allows attackers to execute arbitrary web scripts or HTML via injecting a crafted payload into the Print Name parameter at /rest/staffResource/update.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79
References: https://github.com/VvV1per/Vulnerability-Research-CVEs/tree/main/CVE-2024-89636
CVE: CVE-2025-1844
Published: 2025-03-03
Description: A vulnerability, which was classified as critical, was found in ESAFENET CDG 5.6.3.154.205_20250114. Affected is an unknown function of the file /CDGServer3/logManagement/backupLogDetail.jsp. The manipulation of the argument logTaskId leads to sql injection. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.
CVSS Score: 6.3 (MEDIUM)
CWE: CWE-74, CWE-89, CWE-89
References: https://github.com/666lail/report/blob/main/tmp/1.md; https://vuldb.com/?ctiid.298110; https://vuldb.com/?id.298110
CVE: CVE-2025-1845
Published: 2025-03-03
Description: A vulnerability has been found in ESAFENET DSM 3.1.2 and classified as critical. Affected by this vulnerability is the function examExportPDF of the file /admin/plan/examExportPDF. The manipulation of the argument s leads to command injection. The attack can be launched remotely. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.
CVSS Score: 6.3 (MEDIUM)
CWE: CWE-74, CWE-77, CWE-77
References: https://github.com/666lail/report/blob/main/tmp/2.md; https://vuldb.com/?ctiid.298111; https://vuldb.com/?id.298111
CVE: CVE-2025-1846
Published: 2025-03-03
Description: A vulnerability was found in zj1983 zz up to 2024-8. It has been declared as problematic. This vulnerability affects the function deleteLocalFile of the file src/main/java/com/futvan/z/system/zfile/ZfileAction.java of the component File Handler. The manipulation of the argument zids leads to denial of service. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-404, CWE-404
References: https://github.com/caigo8/CVE-md/blob/main/zz/zz_2024_8%E4%BB%BB%E6%84%8F%E6%96%87%E4%BB%B6%E5%88%A0%E9%99%A4.md; https://vuldb.com/?ctiid.298114; https://vuldb.com/?id.298114
CVE: CVE-2025-1847
Published: 2025-03-03
Description: A vulnerability was found in zj1983 zz up to 2024-8. It has been rated as critical. This issue affects some unknown processing. The manipulation leads to improper authorization. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.
CVSS Score: 6.3 (MEDIUM)
CWE: CWE-266, CWE-285
References: https://github.com/caigo8/CVE-md/blob/main/zz/ZZ_2024_8%E5%9E%82%E7%9B%B4%E8%B6%8A%E6%9D%83.md; https://vuldb.com/?ctiid.298115; https://vuldb.com/?id.298115
CVE: CVE-2025-20644
Published: 2025-03-03
Description: In Modem, there is a possible memory corruption due to incorrect error handling. This could lead to remote denial of service, if a UE has connected to a rogue base station controlled by the attacker, with no additional execution privileges needed. User interaction is not needed for exploitation. Patch ID: MOLY01525673; Issue ID: MSV-2747.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-1286
References: https://corp.mediatek.com/product-security-bulletin/March-2025