What’s Vulnerable › Vulnerabilities

CVE-2025-47357: Missing Authentication for Critical Function in SMSS

• Severity: high (CVSS 7.8 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 0.1% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2025-11-04 · updated 2026-10-18
• Weakness: CWE-306

Description

Information Disclosure when a user-level driver performs QFPROM read or write operations on Fuse regions.

Affected products

• Qualcomm Qam8255P Firmware: all versions
• Qualcomm Qam8620P Firmware: all versions
• Qualcomm Qam8650P Firmware: all versions
• Qualcomm Qam8775P Firmware: all versions
• Qualcomm Qamsrv1H Firmware: all versions
• Qualcomm Qamsrv1M Firmware: all versions
• Qualcomm Qca6595 Firmware: all versions
• Qualcomm Qca6595Au Firmware: all versions
• Qualcomm Qca6678Aq Firmware: all versions
• Qualcomm Qca6696 Firmware: all versions
• Qualcomm Qca6698Aq Firmware: all versions
• Qualcomm Qca6797Aq Firmware: all versions
• Qualcomm Qcs9100 Firmware: all versions
• Qualcomm Sa7255P Firmware: all versions
• Qualcomm Sa7775P Firmware: all versions
• Qualcomm Sa8255P Firmware: all versions
• Qualcomm Sa8620P Firmware: all versions
• Qualcomm Sa8650P Firmware: all versions
• Qualcomm Sa8770P Firmware: all versions
• Qualcomm Sa8775P Firmware: all versions
• Qualcomm Sa9000P Firmware: all versions
• Qualcomm Srv1H Firmware: all versions
• Qualcomm Srv1L Firmware: all versions
• Qualcomm Srv1M Firmware: all versions

References

• https://docs.qualcomm.com/product/publicresources/securitybulletin/november-2025-bulletin.html

Get alerted when CVE-2025-47357 or the next vulnerability affects your stack