CVE-2025-27066: Qualcomm 315 5G IoT Modem Firmware DOS

CVE-2025-27066 Overview

CVE-2025-27066 is a transient denial of service (DoS) vulnerability affecting Qualcomm wireless firmware across an extensive range of products including mobile platforms, networking chipsets, automotive systems, and IoT devices. The vulnerability occurs during the processing of Access Network Query Protocol (ANQP) messages, which are used in Wi-Fi Passpoint (Hotspot 2.0) implementations for network discovery and selection.

ANQP is a query/response protocol that allows Wi-Fi clients to discover information about access points and networks before association. Malformed or specially crafted ANQP messages can trigger an assertion failure in the firmware, causing a temporary service disruption. The vulnerability is classified under CWE-617 (Reachable Assertion), indicating that an attacker can trigger an assertion that was intended for debugging purposes but remains active in production code.

Critical Impact

This vulnerability enables remote attackers to cause temporary denial of service on affected Qualcomm-based devices by sending malicious ANQP messages over the network, potentially disrupting wireless connectivity for mobile devices, networking equipment, automotive systems, and IoT infrastructure.

Affected Products

• Qualcomm Snapdragon Mobile Platforms (4 Gen 1/2, 6xx, 7xx, 8xx series including 8 Gen 1/2/3)
• Qualcomm FastConnect Wi-Fi Chipsets (6200, 6700, 6800, 6900, 7800)
• Qualcomm IPQ Networking Processors (IPQ4xxx, IPQ5xxx, IPQ6xxx, IPQ8xxx, IPQ9xxx series)
• Qualcomm QCN Wi-Fi Chipsets (QCN5xxx, QCN6xxx, QCN7xxx, QCN9xxx series)
• Qualcomm Automotive Platforms (SA4xxx, SA6xxx, SA7xxx, SA8xxx series)
• Qualcomm 5G Modem-RF Systems (Snapdragon X32, X35, X50, X55, X62, X65, X72, X75)
• Qualcomm XR/AR Platforms (Snapdragon XR1, XR2, AR1 Gen 1, AR2 Gen 1)
• Qualcomm Compute Platforms (Snapdragon 7c, 8c, 8cx series)
• Qualcomm Robotics Platforms (RB2, RB3, RB5)
• Qualcomm WCN Connectivity Chipsets (WCN3xxx, WCN6xxx, WCN7xxx series)

Discovery Timeline

• August 6, 2025 - CVE-2025-27066 published to NVD
• November 28, 2025 - Last updated in NVD database

Technical Details for CVE-2025-27066

Vulnerability Analysis

This vulnerability exists within the ANQP message parsing logic in Qualcomm wireless firmware. ANQP (Access Network Query Protocol) is defined in IEEE 802.11u and forms the foundation of Wi-Fi Passpoint functionality, allowing devices to query access points for network information such as venue names, network authentication types, roaming consortiums, and IP address availability.

The firmware contains an assertion check that can be triggered by malformed ANQP response data. When the assertion condition fails, the wireless subsystem experiences a transient denial of service condition. The "transient" nature indicates that the device can recover from this state, typically through automatic reconnection or subsystem restart, but the disruption impacts connectivity during the recovery period.

The attack can be executed from the network without requiring any authentication or user interaction, making it particularly concerning for public Wi-Fi environments where Passpoint is commonly deployed. An attacker within radio range or controlling a rogue access point could exploit this vulnerability to repeatedly disrupt wireless connectivity for affected devices.

Root Cause

The root cause is classified as CWE-617 (Reachable Assertion). The firmware contains an assertion statement intended to catch invalid states during development that remains active in production builds. When processing certain ANQP messages, the code reaches a state that violates the assertion's expected conditions, causing the assertion to fail and triggering a denial of service condition.

Assertion failures in embedded firmware typically result in subsystem crashes or resets, as assertions are designed to halt execution when invariants are violated. In wireless firmware, this manifests as loss of connectivity until the Wi-Fi subsystem recovers.

Attack Vector

The vulnerability can be exploited remotely over a network connection. An attacker can trigger the vulnerability by:

1. Operating a rogue access point that advertises Passpoint (Hotspot 2.0) capability
2. Waiting for a victim device to send ANQP queries during network discovery
3. Responding with a malicious ANQP response containing specially crafted data that triggers the assertion
4. Alternatively, performing a man-in-the-middle attack to inject malformed ANQP responses into legitimate network discovery exchanges

The attack requires no authentication, no privileges on the target device, and no user interaction. The attacker only needs to be within wireless range of the target device or have the ability to inject packets into the network path.

The vulnerability affects the confidentiality and integrity aspects minimally (no data exposure or modification), but has high availability impact due to the service disruption it causes.

Detection Methods for CVE-2025-27066

Indicators of Compromise

• Unexpected Wi-Fi disconnections or subsystem restarts on affected devices
• Device logs showing WLAN firmware crashes or assertion failures during Passpoint/Hotspot 2.0 operations
• Repeated Wi-Fi reconnection attempts following exposure to specific access points
• Crash reports indicating failures in ANQP message processing components

Detection Strategies

• Monitor device telemetry for unusual patterns of Wi-Fi subsystem restarts or firmware recovery events
• Implement wireless intrusion detection systems (WIDS) to identify suspicious Passpoint access points or anomalous ANQP traffic patterns
• Review system logs for assertion failure messages or crash dumps related to WLAN firmware components
• Deploy network monitoring to detect access points advertising Passpoint capability with unusual or malformed capability information

Monitoring Recommendations

• Enable detailed logging for Wi-Fi subsystem events on critical infrastructure devices
• Implement alerting for elevated rates of wireless connectivity disruptions across device fleets
• Monitor for the presence of unauthorized or suspicious Passpoint-enabled access points in the wireless environment
• Track firmware versions across affected device deployments to prioritize patching efforts

How to Mitigate CVE-2025-27066

Immediate Actions Required

• Apply firmware updates from Qualcomm and device manufacturers as they become available through the August 2025 security bulletin
• For critical infrastructure, consider temporarily disabling Passpoint (Hotspot 2.0) functionality if not operationally required
• Implement network segmentation to limit exposure of affected devices to potentially malicious wireless networks
• Monitor affected devices for unusual connectivity behavior and investigate any anomalies

Patch Information

Qualcomm has addressed this vulnerability in their August 2025 Security Bulletin. Organizations should obtain firmware updates through their device manufacturers or OEMs, as Qualcomm distributes patches through its customer channels. The Qualcomm August 2025 Security Bulletin provides complete details on the affected products and patch availability.

Device manufacturers typically incorporate Qualcomm security patches into their monthly or quarterly security updates. For Android devices, these fixes are often distributed through Android security bulletins. For networking equipment and automotive systems, contact the device vendor for specific patch timelines.

Workarounds

• Disable Passpoint/Hotspot 2.0 functionality on affected devices where this feature is not required for operations
• Configure devices to avoid automatic connection to unknown Passpoint networks
• Restrict wireless network access in sensitive environments to known and trusted access points only
• For IoT and embedded devices, implement network isolation to limit the attack surface

# Example: Disable Passpoint on Linux-based systems with wpa_supplicant
# Add to /etc/wpa_supplicant/wpa_supplicant.conf
# interworking=0
# hs20=0

# For Android devices via ADB (requires root or engineering builds)
# adb shell settings put global wifi_hotspot2_enabled 0

# For enterprise deployments, consider MDM policies to disable Passpoint
# Consult device vendor documentation for specific configuration options