Vulnerabilities ›

CVE-2025-47406

Medium

CWE-126 — Weakness Type

                    Published: May 4, 2026                      ·  Modified: May 7, 2026                      ·  Source: NVD                

CVSS v3

6.1

🔗 NVD Official

📄 Description (English)

Information Disclosure while processing IOCTL handler callbacks without verifying buffer size.

🤖 AI Executive Summary

CVE-2025-47406 is a medium-severity information disclosure vulnerability in Qualcomm wireless and IoT firmware affecting multiple chipsets used in enterprise and consumer devices. The vulnerability stems from improper buffer size validation in IOCTL handler callbacks, allowing local attackers to read sensitive kernel memory. While no public exploit exists and patches are unavailable, the widespread use of affected Qualcomm chipsets in Saudi telecommunications and enterprise infrastructure presents a notable risk.

📄 Description (Arabic)

🤖 AI Intelligence Analysis Analyzed: May 23, 2026 17:33

🇸🇦 Saudi Arabia Impact Assessment

Saudi telecommunications operators (STC, Mobily, Zain) utilizing Qualcomm FastConnect chipsets in network infrastructure and enterprise equipment face potential exposure of sensitive network configuration data and authentication credentials. Government agencies and critical infrastructure operators using affected IoT and wireless devices may experience unauthorized information disclosure. Banking and financial institutions deploying Qualcomm-based enterprise networking equipment could have payment system metadata exposed. Healthcare sector organizations using affected wireless medical devices and enterprise networks are at risk of HIPAA-equivalent data exposure. The vulnerability's local-only attack vector limits immediate risk but poses significant concern for insider threats and compromised device scenarios.

🏢 Affected Saudi Sectors

Telecommunications (STC, Mobily, Zain) Government and Public Administration Banking and Financial Services Healthcare Energy and Utilities Enterprise IT Infrastructure IoT and Smart Devices

🎯 MITRE ATT&CK Techniques

T1005 - Data from Local System T1007 - System Service Discovery T1012 - Query Registry T1057 - Process Discovery T1518 - Software Discovery T1526 - System Information Discovery T1087 - Account Discovery

⚖️ Saudi Risk Score (AI)

6.2

/ 10.0

🔧 Remediation Steps (English)

Immediate Actions:

1. Inventory all devices using affected Qualcomm chipsets (FastConnect 6700/6900/7800, QCM5430/6490, IQX5121/7181, Cologne, QCA0000, VC3 Platform)

2. Restrict local access to affected devices through physical security and access controls

3. Implement kernel address space layout randomization (KASLR) if not already enabled

4. Monitor for suspicious IOCTL calls targeting wireless/network drivers



Compensating Controls:

5. Deploy SELinux/AppArmor policies restricting unprivileged process access to device drivers

6. Implement user-space driver isolation where possible

7. Enable audit logging for all IOCTL operations on affected devices

8. Restrict sudo/privileged access to trusted administrators only

9. Apply principle of least privilege to all user accounts



Detection Rules:

10. Monitor for repeated failed IOCTL calls with varying buffer sizes

11. Alert on kernel memory reads from user-space processes

12. Track access patterns to /dev/qca*, /dev/fastconnect* device nodes

13. Implement memory access monitoring for sensitive kernel structures



Patching Strategy:

14. Contact Qualcomm for firmware update timeline and availability

15. Prepare device firmware update procedures for rapid deployment once patches available

16. Test patches in isolated lab environment before production deployment

🔧 خطوات المعالجة (العربية)

الإجراءات الفورية:

1. إجراء جرد شامل لجميع الأجهزة التي تستخدم رقاقات كوالكوم المتأثرة

2. تقييد الوصول المحلي للأجهزة المتأثرة من خلال الأمان المادي والتحكم في الوصول

3. تفعيل عشوائية تخطيط مساحة عنوان النواة (KASLR) إن لم تكن مفعلة

4. مراقبة استدعاءات IOCTL المريبة الموجهة لمحركات الشبكة اللاسلكية

الضوابط البديلة:

5. نشر سياسات SELinux/AppArmor لتقييد وصول العمليات غير المميزة لمحركات الأجهزة

6. تنفيذ عزل محرك المستخدم حيث أمكن

7. تفعيل تسجيل التدقيق لجميع عمليات IOCTL على الأجهزة المتأثرة

8. تقييد وصول sudo/الامتيازات للمسؤولين الموثوقين فقط

9. تطبيق مبدأ أقل امتياز على جميع حسابات المستخدمين

قواعد الكشف:

10. مراقبة استدعاءات IOCTL المتكررة الفاشلة بأحجام مخزن مؤقت مختلفة

11. التنبيه على قراءات ذاكرة النواة من عمليات المستخدم

12. تتبع أنماط الوصول إلى عقد الأجهزة

13. تنفيذ مراقبة الوصول للذاكرة للهياكل الحساسة في النواة

استراتيجية التصحيح:

14. الاتصال بكوالكوم للحصول على الجدول الزمني وتوفر تحديثات البرامج الثابتة

15. تحضير إجراءات تحديث برامج الأجهزة للنشر السريع عند توفر التصحيحات

16. اختبار التصحيحات في بيئة معملية معزولة قبل النشر الإنتاجي

📋 Regulatory Compliance Mapping

🟢 NCA ECC 2024

ECC 2024 A.5.1.1 - Access Control Policies ECC 2024 A.5.2.1 - User Registration and De-registration ECC 2024 A.8.1.1 - Asset Inventory and Control ECC 2024 A.12.2.1 - Change Management Procedures ECC 2024 A.12.6.1 - Management of Technical Vulnerabilities

🔵 SAMA CSF

ID.AM-2 - Software Platforms and Applications PR.DS-1 - Data Security Management PR.IP-12 - Vulnerability Management DE.CM-8 - Vulnerability Scans RS.MI-2 - Incident Response and Recovery

🟡 ISO 27001:2022

A.5.1.1 - Policies for information security A.8.1.1 - Inventory of assets A.12.2.1 - Change management A.12.6.1 - Management of technical vulnerabilities A.14.2.1 - Secure development policy

🟣 PCI DSS v4.0.1

Requirement 2.2 - Configuration standards for system components Requirement 6.2 - Security patches and updates Requirement 11.2 - Vulnerability scanning

🔗 References & Sources 1

🔗

https://docs.qualcomm.com/product/publicresources/securitybulletin/may-2026-bulletin.html

product-security@qualcomm.com

Vendor Advisory

📦 Affected Products / CPE 31 entries

qualcomm:cologne_firmware:-

qualcomm:fastconnect_6700_firmware:-

qualcomm:fastconnect_6900_firmware:-

qualcomm:fastconnect_7800_firmware:-

qualcomm:iqx5121_firmware:-

qualcomm:iqx7181_firmware:-

qualcomm:qca0000_firmware:-

qualcomm:qcm5430_firmware:-

qualcomm:qcm6490_firmware:-

qualcomm:video_collaboration_vc3_platform_firmware:-

qualcomm:sc8380xp_firmware:-

qualcomm:snapdragon_7c\+_gen_3_compute_firmware:-

qualcomm:snapdragon_8cx_gen_3_compute_firmware:-

qualcomm:wcd9370_firmware:-

qualcomm:wcd9375_firmware:-

qualcomm:wcd9378c_firmware:-

qualcomm:wcd9380_firmware:-

qualcomm:wcd9385_firmware:-

qualcomm:wsa8830_firmware:-

qualcomm:wsa8835_firmware:-

qualcomm:wsa8840_firmware:-

qualcomm:wsa8845_firmware:-

qualcomm:wsa8845h_firmware:-

qualcomm:x2000077_firmware:-

qualcomm:x2000086_firmware:-

qualcomm:x2000090_firmware:-

qualcomm:x2000092_firmware:-

qualcomm:x2000094_firmware:-

qualcomm:xg101002_firmware:-

qualcomm:xg101032_firmware:-

qualcomm:xg101039_firmware:-

📊 CVSS Score

6.1

/ 10.0 — Medium

📊 CVSS Vector

CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:L

Attack VectorL — Low / Local

Attack ComplexityL — Low / Local

Privileges RequiredL — Low / Local

User InteractionN — None / Network

ScopeU — Unchanged

ConfidentialityH — High

IntegrityN — None / Network

AvailabilityL — Low / Local

📋 Quick Facts

Severity Medium

CVSS Score6.1

CWECWE-126

EPSS0.01%

Exploit No

Patch ✗ No

Published 2026-05-04

Source Feed nvd

🇸🇦 Saudi Risk Score

6.2

/ 10.0 — Saudi Risk

Priority: HIGH

🏷️ Tags

CWE-126

🏢 Vendor Advisories

🔗 https://docs.qualcomm.com/product/publicresources/se...

⚡ Actions

🔗 NVD Official Page ⚡ Exploit-DB Search 🐙 GitHub PoC Search 🎯 MITRE ATT&CK 📊 CVE Details

CVE-2025-47406

Introduce Yourself

Sign In Required