CVE-2025-31710

In engineermode service, there is a possible command injection due to improper input validation. This could lead to local escalation of privilege with no additional execution privileges needed.

CVSS v3 5.9 MEDIUM

5.9^/10

CVSS v3 : MEDIUM

V3 Legend

Vector :

Exploitability : 2.5 / Impact : 3.4

Attack Vector LOCAL

Attack Complexity LOW

Privileges Required NONE

User Interaction NONE

Confidentiality Impact LOW

Integrity Impact LOW

Availability Impact LOW

Scope UNCHANGED

References

Link	Resource
https://www.unisoc.com/en_us/secy/announcementDetail/1929773763314909186	Vendor Advisory

Configurations

Configuration 1 (hide)

AND

OR	cpe:2.3:o:google:android:13.0:::::::*
	cpe:2.3:o:google:android:14.0:::::::*
	cpe:2.3:o:google:android:15.0:::::::*

OR	cpe:2.3:h:unisoc:s8000:-:::::::*
	cpe:2.3:h:unisoc:sc9863a:-:::::::*
	cpe:2.3:h:unisoc:t606:-:::::::*
	cpe:2.3:h:unisoc:t612:-:::::::*
	cpe:2.3:h:unisoc:t616:-:::::::*
	cpe:2.3:h:unisoc:t750:-:::::::*
	cpe:2.3:h:unisoc:t760:-:::::::*
	cpe:2.3:h:unisoc:t765:-:::::::*
	cpe:2.3:h:unisoc:t770:-:::::::*
	cpe:2.3:h:unisoc:t820:-:::::::*
	cpe:2.3:h:unisoc:t8300:-:::::::*
	cpe:2.3:h:unisoc:t9300:-:::::::*

History

10 Jun 2025, 15:15

Type	Values Removed	Values Added
References	~~() https://www.unisoc.com/en_us/secy/announcementDetail/1929773763314909186 -~~	() https://www.unisoc.com/en_us/secy/announcementDetail/1929773763314909186 - Vendor Advisory
First Time		Unisoc s8000 Unisoc t616 Unisoc t765 Google android Unisoc t612 Unisoc sc9863a Unisoc t750 Unisoc t770 Unisoc t760 Unisoc t9300 Unisoc t820 Unisoc t606 Unisoc t8300 Google Unisoc
CPE		cpe:2.3:h:unisoc:t612:-:::::::* cpe:2.3:o:google:android:15.0:::::::* cpe:2.3:o:google:android:13.0:::::::* cpe:2.3:h:unisoc:s8000:-:::::::* cpe:2.3:h:unisoc:t606:-:::::::* cpe:2.3:h:unisoc:t750:-:::::::* cpe:2.3:h:unisoc:t760:-:::::::* cpe:2.3:h:unisoc:t765:-:::::::* cpe:2.3:h:unisoc:t8300:-:::::::* cpe:2.3:o:google:android:14.0:::::::* cpe:2.3:h:unisoc:t770:-:::::::* cpe:2.3:h:unisoc:sc9863a:-:::::::* cpe:2.3:h:unisoc:t616:-:::::::* cpe:2.3:h:unisoc:t9300:-:::::::* cpe:2.3:h:unisoc:t820:-:::::::*

03 Jun 2025, 16:15

Type	Values Removed	Values Added
CWE		CWE-77
Summary		(es) En el servicio en modo ingeniero, existe una posible inyección de comandos debido a una validación de entrada incorrecta. Esto podría provocar una escalada local de privilegios sin necesidad de permisos de ejecución adicionales.

03 Jun 2025, 06:15

Type	Values Removed	Values Added
New CVE

Information

Published : 2025-06-03 06:15

Updated : 2025-06-10 15:15

NVD link : CVE-2025-31710

Mitre link : CVE-2025-31710

CVE.ORG link : CVE-2025-31710

JSON object : View

Products Affected

unisoc

t612
t765
s8000
t770
t616
t750
t760
sc9863a
t606
t8300
t820
t9300

google

android

CWE

CWE-77

Improper Neutralization of Special Elements used in a Command ('Command Injection')

{"id": "CVE-2025-31710", "cveTags": [], "metrics": {"cvssMetricV31": [{"type": "Secondary", "source": "security@unisoc.com", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 5.9, "attackVector": "LOCAL", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L", "integrityImpact": "LOW", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "LOW", "privilegesRequired": "NONE", "confidentialityImpact": "LOW"}, "impactScore": 3.4, "exploitabilityScore": 2.5}, {"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 8.4, "attackVector": "LOCAL", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "NONE", "confidentialityImpact": "HIGH"}, "impactScore": 5.9, "exploitabilityScore": 2.5}]}, "published": "2025-06-03T06:15:27.310", "references": [{"url": "https://www.unisoc.com/en_us/secy/announcementDetail/1929773763314909186", "tags": ["Vendor Advisory"], "source": "security@unisoc.com"}], "vulnStatus": "Analyzed", "weaknesses": [{"type": "Secondary", "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "description": [{"lang": "en", "value": "CWE-77"}]}], "descriptions": [{"lang": "en", "value": "In engineermode service, there is a possible command injection due to improper input validation. This could lead to local escalation of privilege with no additional execution privileges needed."}, {"lang": "es", "value": "En el servicio en modo ingeniero, existe una posible inyecci\u00f3n de comandos debido a una validaci\u00f3n de entrada incorrecta. Esto podr\u00eda provocar una escalada local de privilegios sin necesidad de permisos de ejecuci\u00f3n adicionales."}], "lastModified": "2025-06-10T15:15:23.847", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:o:google:android:13.0:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "879FFD0C-9B38-4CAA-B057-1086D794D469"}, {"criteria": "cpe:2.3:o:google:android:14.0:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "2700BCC5-634D-4EC6-AB67-5B678D5F951D"}, {"criteria": "cpe:2.3:o:google:android:15.0:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "8538774C-906D-4B03-A3E7-FA7A55E0DA9E"}], "operator": "OR"}, {"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:h:unisoc:s8000:-:*:*:*:*:*:*:*", "vulnerable": false, "matchCriteriaId": "FDE05D06-C798-4217-8858-8C5DC2C94751"}, {"criteria": "cpe:2.3:h:unisoc:sc9863a:-:*:*:*:*:*:*:*", "vulnerable": false, "matchCriteriaId": "DE00DFDE-97DD-4D33-B580-73FEF677C71B"}, {"criteria": "cpe:2.3:h:unisoc:t606:-:*:*:*:*:*:*:*", "vulnerable": false, "matchCriteriaId": "905E39DD-7948-40A4-B042-EBB9A9591347"}, {"criteria": "cpe:2.3:h:unisoc:t612:-:*:*:*:*:*:*:*", "vulnerable": false, "matchCriteriaId": "98408A48-561A-49D1-967F-834311742B7F"}, {"criteria": "cpe:2.3:h:unisoc:t616:-:*:*:*:*:*:*:*", "vulnerable": false, "matchCriteriaId": "756E5850-CDC7-46C2-BAFC-1E2A359A2709"}, {"criteria": "cpe:2.3:h:unisoc:t750:-:*:*:*:*:*:*:*", "vulnerable": false, "matchCriteriaId": "B37CC5BC-D87D-497A-B8A1-38718AB4F116"}, {"criteria": "cpe:2.3:h:unisoc:t760:-:*:*:*:*:*:*:*", "vulnerable": false, "matchCriteriaId": "3D965CCA-C963-49E4-ACF0-2A9F458AF470"}, {"criteria": "cpe:2.3:h:unisoc:t765:-:*:*:*:*:*:*:*", "vulnerable": false, "matchCriteriaId": "CFCCDED4-7E32-48CB-909D-06001C35E745"}, {"criteria": "cpe:2.3:h:unisoc:t770:-:*:*:*:*:*:*:*", "vulnerable": false, "matchCriteriaId": "0FFEF06A-E3E0-486F-89CC-D52FF3F26F0B"}, {"criteria": "cpe:2.3:h:unisoc:t820:-:*:*:*:*:*:*:*", "vulnerable": false, "matchCriteriaId": "49601008-D3FF-47CC-B961-6FDDFC7A0596"}, {"criteria": "cpe:2.3:h:unisoc:t8300:-:*:*:*:*:*:*:*", "vulnerable": false, "matchCriteriaId": "DC7743D5-B187-48D4-BC77-D8DCDF263166"}, {"criteria": "cpe:2.3:h:unisoc:t9300:-:*:*:*:*:*:*:*", "vulnerable": false, "matchCriteriaId": "027BA3F8-B2E3-4D71-977D-E86E8D539269"}], "operator": "OR"}], "operator": "AND"}], "sourceIdentifier": "security@unisoc.com"}

5.9 /10