In the vowifi service, there is a possible command injection due to improper input validation. This vulnerability could lead to remote escalation of privilege without requiring additional execution privileges.
Details
| Severity | Base Score | CVE |
|---|---|---|
| CRITICAL | 9.8 | CVE-2025-31715 |
Exploitation
To exploit this vulnerability, an attacker can send specially crafted input to the vowifi service, which may allow them to execute arbitrary commands on the affected system, leading to privilege escalation.
Affected Products
- Vowifi Service: A service that enables voice calls over Wi-Fi, which is susceptible to command injection due to improper input validation.
Mitigation
To mitigate this vulnerability, it is recommended to implement proper input validation and sanitization in the vowifi service to prevent command injection attacks.