CVE-2025-27073: Qualcomm Immersive Home 214 DOS Vulnerability

CVE-2025-27073 Overview

CVE-2025-27073 is a denial of service vulnerability affecting Qualcomm firmware across a wide range of mobile, networking, and embedded platforms. The vulnerability occurs during the creation of Neighbor Discovery Protocol (NDP) instances, allowing remote attackers to trigger a transient denial of service condition without requiring user interaction or authentication.

Critical Impact

Network-accessible denial of service affecting critical Qualcomm chipsets used in smartphones, networking equipment, automotive systems, and IoT devices. Exploitation can disrupt device availability without requiring any user interaction.

Affected Products

• Qualcomm Snapdragon 8 Gen 1/2/3 Mobile Platforms
• Qualcomm Snapdragon 865/865+/870 5G Mobile Platforms
• Qualcomm IPQ Series Networking Processors (IPQ5010, IPQ6018, IPQ8xxx, IPQ9xxx)
• Qualcomm FastConnect 6800/6900/7800 Wireless Subsystems
• Qualcomm WCN Series Wi-Fi Chipsets (WCN6450, WCN6650, WCN6740, WCN7xxx)
• Qualcomm Automotive Platforms (SA7255P, SA8255P, SA8775P, QAM8255P)
• Qualcomm Immersive Home 214/216/316/318 Platforms
• Qualcomm Snapdragon XR2 5G and AR1/AR2 Gen 1 Platforms

Discovery Timeline

• August 6, 2025 - CVE-2025-27073 published to NVD
• August 20, 2025 - Last updated in NVD database

Technical Details for CVE-2025-27073

Vulnerability Analysis

This vulnerability is classified under CWE-617 (Reachable Assertion), indicating that the firmware contains an assertion that can be triggered by a remote attacker, causing the affected component to terminate or enter an unstable state. The flaw manifests during the NDP (Neighbor Discovery Protocol) instance creation process within the network stack of affected Qualcomm chipsets.

NDP is a critical IPv6 protocol used for address autoconfiguration, neighbor discovery, and router discovery. When creating NDP instances, the firmware fails to properly handle certain edge cases or malformed inputs, leading to an assertion failure that causes a transient denial of service condition. The vulnerability can be exploited remotely over the network without requiring any privileges or user interaction.

The widespread impact stems from the common codebase shared across Qualcomm's extensive chipset portfolio, affecting devices ranging from consumer smartphones to enterprise networking equipment and automotive systems.

Root Cause

The root cause is a reachable assertion (CWE-617) in the NDP instance creation code path. The firmware includes a debug or validation assertion that was not intended to be reachable under normal operation but can be triggered through crafted network packets or specific timing conditions. When this assertion is triggered, the affected network subsystem enters a denial of service state, disrupting connectivity until the system recovers or is restarted.

Attack Vector

The vulnerability is exploitable over the network, making it accessible to remote attackers. The attack does not require authentication, user interaction, or any special privileges, significantly lowering the barrier to exploitation. An attacker could send specially crafted IPv6 NDP packets to a vulnerable device to trigger the assertion failure.

The attack flow involves:

1. An attacker identifies a device running vulnerable Qualcomm firmware with IPv6 enabled
2. The attacker sends malformed or specially crafted NDP packets to the target device
3. The firmware's NDP instance creation code encounters an unexpected condition
4. The assertion check fails, causing the network subsystem to crash or become unresponsive
5. The device experiences a transient denial of service until recovery

Detection Methods for CVE-2025-27073

Indicators of Compromise

• Unexpected network subsystem crashes or restarts on devices with Qualcomm chipsets
• Intermittent connectivity loss on Wi-Fi or cellular connections
• Elevated counts of malformed or unexpected IPv6 NDP packets in network logs
• Device logs showing assertion failures in network-related firmware components

Detection Strategies

• Monitor for unusual IPv6 NDP traffic patterns, particularly malformed Router Solicitation, Router Advertisement, Neighbor Solicitation, or Neighbor Advertisement messages
• Implement network intrusion detection rules to identify anomalous NDP packet rates or malformed headers
• Deploy endpoint detection solutions to monitor for firmware-level crashes or unexpected network subsystem restarts
• Enable verbose logging on network infrastructure to capture potential exploitation attempts

Monitoring Recommendations

• Configure SIEM systems to correlate network anomalies with device availability issues
• Establish baseline NDP traffic patterns to detect statistical deviations
• Monitor device health metrics for unexpected reboots or connectivity disruptions
• Review Qualcomm security bulletins and vendor advisories for updated threat intelligence

How to Mitigate CVE-2025-27073

Immediate Actions Required

• Review the Qualcomm August 2025 Security Bulletin for specific patch information
• Inventory all devices using affected Qualcomm chipsets across your environment
• Prioritize patching for network-exposed devices and critical infrastructure
• Consider implementing network segmentation to limit exposure of vulnerable devices

Patch Information

Qualcomm has released security patches addressing this vulnerability as part of the August 2025 Security Bulletin. Device manufacturers (OEMs) will distribute these fixes through their respective firmware update channels. Organizations should contact their device vendors for specific patch availability timelines.

For enterprise environments with SentinelOne deployed, the Singularity platform provides:

• Network anomaly detection to identify potential exploitation attempts
• Endpoint monitoring for firmware-level instability indicators
• Automated threat intelligence updates incorporating Qualcomm vulnerability information

Workarounds

• Where possible, disable IPv6 on devices where it is not required to reduce the attack surface
• Implement strict ingress filtering on network perimeters to block potentially malicious NDP traffic
• Deploy network access controls to limit which systems can send NDP packets to vulnerable devices
• Monitor affected devices for stability issues and isolate any showing signs of exploitation

# Example: Disable IPv6 on Linux systems with affected Qualcomm Wi-Fi adapters
# Note: This is a temporary workaround and may impact IPv6-dependent services

# Disable IPv6 on a specific interface
sysctl -w net.ipv6.conf.wlan0.disable_ipv6=1

# Make persistent across reboots (add to /etc/sysctl.conf)
echo "net.ipv6.conf.wlan0.disable_ipv6=1" >> /etc/sysctl.conf