CVE-2025-30509

LowCVSS 3.3/10Last modified Oct 19, 2026

Description

Improper input validation for some Intel QuickAssist Technology software before version 2.6.0 within Ring 3: User Applications may allow an escalation of privilege. System software adversary with an authenticated user combined with a low complexity attack may enable data manipulation. This result may potentially occur via local access when attack requirements are not present without special internal knowledge and requires no user interaction. The potential vulnerability may impact the confidentiality (none), integrity (low) and availability (none) of the vulnerable system, resulting in subsequent system confidentiality (none), integrity (none) and availability (none) impacts.

Metrics

CVSS 3.1 3.3/10CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N

Weakness enumeration

CWE-20

Affected software

No affected versions have been published.

Timeline

Published: Nov 11, 2025
Last modified: Oct 19, 2026
NVD status: Analyzed

Related CVEs from 2025

CVE-2025-30516.5Linux::Statm::Tiny for Perl before 0.0701 allows untrusted code from the current working directory ('.') to be loaded similar to CVE-2016-12 CVE-2025-305109.8An attacker can upload an arbitrary file instead of a plant image.CVE-2025-305115.4An authenticated attacker can achieve stored XSS by exploiting improper sanitization of the plant name value while adding or editing a plant CVE-2025-305126.5Unauthenticated attackers can send configuration settings to device and possible perform physical actions remotely (e.g., on/off).CVE-2025-305137.9Race condition for some TDX Module within Ring 0: Hypervisor may allow an escalation of privilege. System software adversary with a privileg CVE-2025-305145.3Unauthenticated attackers can obtain restricted information about a user's smart device collections (i.e., "scenes").CVE-2025-305158.8CyberData 011209 Intercom could allow an authenticated attacker to upload arbitrary files to multiple locations within the system.CVE-2025-305167.5Mattermost Mobile Apps versions <=2.25.0 fail to terminate sessions during logout under certain conditions (e.g. poor connectivity), allowi CVE-2025-305186.7Incorrect default permissions for some Intel(R) PresentMon before version 2.3.1 within Ring 3: User Applications may allow an escalation of CVE-2025-305199.8Dover Fueling Solutions ProGauge MagLink LX4 Devices have default root credentials that cannot be changed through standard administrative m CVE-2025-30528.2An arbitrary write vulnerability in Microsoft signed UEFI firmware allows for code execution of untrusted software. This allows an attacker CVE-2025-305207.1Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in crosstec Breezing Forms breezing-forms