CVE-2025-27072

MediumCVSS 5.5/10Last modified Jun 17, 2026

Description

Information disclosure while processing a packet at EAVB BE side with invalid header length.

Metrics

CVSS 3.1 5.5/10CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

Weakness enumeration

CWE-120

Affected software

Vendor	Product	Versions
Qualcomm, Inc.	Snapdragon	QAM8255P; QAM8295P; QAM8620P; QAM8650P; QAM8775P; QAMSRV1H; QAMSRV1M; QCA6574A; QCA6574AU; QCA6595; QCA6595AU; QCA6688AQ; QCA6696; QCA6698AQ; SA6145P; SA6150P; SA6155; SA6155P; SA7255P; SA7775P

References

https://docs.qualcomm.com/product/publicresources/securitybulletin/august-2025-bulletin.htmlVendor Advisory

Timeline

Published: Aug 6, 2025
Last modified: Jun 17, 2026
NVD status: Analyzed

Related CVEs from 2025

CVE-2025-270737.5Transient DOS while creating NDP instance.CVE-2025-270747.8Memory corruption while processing a GP command response.CVE-2025-270757.8Memory corruption while processing IOCTL command with larger buffer in Bluetooth Host.CVE-2025-270767.0Memory corruption while processing simultaneous requests via escape path.CVE-2025-270777.8Memory corruption while processing message in guest VM.CVE-2025-270786.5A vulnerability in a system binary of AOS-8 Instant and AOS-10 AP could allow an authenticated remote attacker to inject commands into the u CVE-2025-270796.0A vulnerability in the file creation process on the command line interface of AOS-8 Instant and AOS-10 AP could allow an authenticated remot CVE-2025-27089.1A vulnerability was identified in zhijiantianya ruoyi-vue-pro 2.4.1. Affected is an unknown function of the file /admin-api/infra/file/uploa CVE-2025-270806.0Vulnerabilities in the command line interface of AOS-CX could allow an authenticated remote attacker to expose sensitive information. Succes CVE-2025-270816.8A potential security vulnerability in HPE NonStop OSM Service Connection Suite could potentially be exploited to allow a local Denial of Ser CVE-2025-270827.2Arbitrary File Write vulnerabilities exist in the web-based management interface of both the AOS-10 GW and AOS-8 Controller/Mobility Conduct CVE-2025-270837.2Authenticated command injection vulnerabilities exist in the AOS-10 GW and AOS-8 Controller/Mobility Conductor web-based management interfac