CVE-2025-47345: Qualcomm Wcd9385 Cryptographic Vulnerability

CVE-2025-47345 Overview

CVE-2025-47345 is a cryptographic weakness affecting license data encryption across a large portfolio of Qualcomm chipsets and firmware. The flaw is tracked under CWE-323: Reusing a Nonce, Key Pair in Encryption, which indicates the affected routine reuses cryptographic material during license data protection. A local attacker with low privileges can leverage the weakness to compromise confidentiality and integrity of protected data on affected devices. The scope of impacted products spans Snapdragon mobile platforms, FastConnect connectivity chips, automotive SA-series SoCs, WCN/WCD/WSA firmware families, and 5G modem-RF systems.

Critical Impact
Local, low-privilege attackers can defeat license data encryption on affected Qualcomm firmware, exposing sensitive material and enabling integrity attacks with scope change to adjacent components.

Affected Products

Qualcomm Snapdragon mobile platforms (Snapdragon 6 Gen 1, Snapdragon 8 Gen 3, SM8750, SM8735, SM8650Q and related)
Qualcomm FastConnect Wi-Fi/Bluetooth firmware (FastConnect 6200, 6700, 6900, 7800) and WCN/WCD/WSA audio and connectivity firmware
Qualcomm automotive and compute SoCs including SA8255P, SA8295P, SA8540P, SA8650P, SA8770P, SA8775P, SC8380XP, and the QCA/QCS/QDU/QAM component families

Discovery Timeline

2026-01-07 - CVE-2025-47345 published to NVD
2026-01 - Qualcomm publishes fix in the January 2026 Security Bulletin
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2025-47345

Vulnerability Analysis

The flaw lives in the cryptographic routine that Qualcomm firmware uses to protect license data. According to the NVD entry, a cryptographic issue may occur while encrypting license data. The CWE-323 classification points to nonce or key-pair reuse — a well-understood failure mode that undermines the confidentiality guarantees of symmetric ciphers and can also allow forgery when authenticated encryption is misused.

Because the affected code runs inside firmware on trusted hardware components, successful exploitation gives the attacker access to protected material that the operating system normally cannot see. The changed scope (S:C) indicates that impact reaches beyond the vulnerable component, which is consistent with license data being consumed by other subsystems on the SoC. Confidentiality and integrity are both affected, while availability is not.

Root Cause

The root cause is improper cryptographic construction in the license data protection path, tracked as CWE-323. When a nonce or initialization vector is reused with the same key, stream cipher keystreams collide and plaintexts can be recovered through XOR of ciphertexts. If the underlying primitive is an authenticated mode such as GCM, nonce reuse additionally exposes the authentication key, allowing arbitrary ciphertext forgery. Either failure mode is sufficient to invalidate the encryption of license data on the affected firmware.

Attack Vector

Exploitation requires local access and low privileges on the device, with no user interaction. A malicious application, compromised low-privilege service, or physically present attacker with a shell can invoke the affected firmware interface and collect ciphertext or influence the inputs to the cryptographic operation. Once enough ciphertext with reused cryptographic material is captured, the attacker recovers plaintext license data or crafts forged tokens that downstream components accept. The Qualcomm security bulletin is the authoritative reference for the exact interfaces and firmware images that must be updated; see the January 2026 Security Bulletin for details.

Detection Methods for CVE-2025-47345

Indicators of Compromise

Unexpected local processes or applications repeatedly invoking license-related firmware interfaces or querying protected key material.
Anomalous access patterns to Qualcomm secure services from non-privileged user contexts on Android or embedded Linux devices.
Presence of unpatched firmware build fingerprints on affected chipsets after the January 2026 Qualcomm bulletin has been released.

Detection Strategies

Inventory managed mobile, automotive, and IoT devices against the affected chipset list and flag those still on pre-January 2026 firmware.
Monitor mobile device management (MDM) attestation and integrity signals for devices reporting Qualcomm components at outdated patch levels.
Correlate device telemetry with vendor security bulletin identifiers to prioritize fleets running impacted SA, SM, QCA, QCS, WCN, WCD, WSA, and FastConnect parts.

Monitoring Recommendations

Track the Qualcomm Product Security page for supplemental advisories referencing CVE-2025-47345 and downstream OEM patch releases.
Alert on installation of applications requesting privileged access to DRM, TEE, or license services on affected devices.
Log and review firmware update transactions to confirm successful deployment of the vendor-supplied fix.

How to Mitigate CVE-2025-47345

Immediate Actions Required

Identify devices in scope by matching deployed hardware against the Qualcomm affected component list published in the January 2026 bulletin.
Deploy the OEM firmware update that incorporates the Qualcomm fix as soon as vendors release it for each device family.
Restrict installation of untrusted local applications on affected devices until updates are applied, since exploitation requires local access.

Patch Information

Qualcomm addressed CVE-2025-47345 in its January 2026 Security Bulletin. The fix is distributed through downstream OEMs — mobile handset vendors, automotive manufacturers, and IoT integrators — as part of their firmware and Android security patch level updates. Operators must confirm that the specific firmware images for the impacted WCD, WCN, WSA, QCA, QCS, SA, SM, SC, SDX, QDU, QAM, FastConnect, and Snapdragon components have been refreshed on each device.

Workarounds

Enforce least-privilege on affected devices and prohibit sideloaded or untrusted applications that could invoke license services locally.
Where the device supports it, disable optional features that rely on the vulnerable license data encryption path until firmware is patched.
Physically protect high-value devices (automotive ECUs, industrial gateways) to reduce the risk of local, hands-on exploitation prior to patching.

bash

# Example: verify Android security patch level on a managed device
adb shell getprop ro.build.version.security_patch
adb shell getprop ro.vendor.build.security_patch

# Compare output against the January 2026 Qualcomm bulletin patch level
# before releasing the device from quarantine.