In the vowifi service, there is a possible command injection due to improper input validation. This vulnerability could lead to remote escalation of privilege without requiring additional execution privileges. It poses a significant risk to the confidentiality, integrity, and availability of affected systems.
Details
| Severity | Base Score | CVE |
|---|---|---|
| CRITICAL | 9.8 | CVE-2025-31715 |
Exploitation
To exploit this vulnerability, an attacker could send specially crafted input to the vowifi service, which would bypass input validation checks. This could allow the attacker to execute arbitrary commands, leading to privilege escalation without needing any prior access or permissions.
Affected Products
- Vowifi Service: A service that enables voice calls over Wi-Fi, which is susceptible to command injection due to improper input validation.
Mitigation
To mitigate this vulnerability, it is recommended to implement proper input validation and sanitization in the vowifi service. Additionally, applying security patches provided by Unisoc and monitoring for unusual activity can help protect against potential exploitation.