CVE-2025-47357 Overview
CVE-2025-47357 is an information disclosure vulnerability affecting a broad range of Qualcomm automotive and connectivity chipsets. The flaw occurs when a user-level driver performs Qualcomm Fuse Programmable Read-Only Memory (QFPROM) read or write operations on Fuse regions. Because access controls are missing on these operations, a local low-privileged actor can read or modify sensitive Fuse data. The issue is tracked as [CWE-306: Missing Authentication for Critical Function] and was published in the Qualcomm November 2025 Security Bulletin.
Critical Impact
A local low-privileged user can trigger QFPROM Fuse region reads or writes, leading to disclosure or corruption of sensitive hardware-level data on affected Qualcomm platforms.
Affected Products
- Qualcomm QAM8255P, QAM8620P, QAM8650P, QAM8775P firmware and hardware
- Qualcomm SA7255P, SA7775P, SA8255P, SA8620P, SA8650P, SA8770P, SA8775P, SA9000P firmware and hardware
- Qualcomm QCA6595, QCA6595AU, QCA6678AQ, QCA6696, QCA6698AQ, QCA6797AQ, QCS9100, QAMSRV1H, QAMSRV1M, SRV1H, SRV1L, SRV1M firmware and hardware
Discovery Timeline
- 2025-11-04 - CVE-2025-47357 published to NVD
- 2025-11-04 - Qualcomm publishes advisory in November 2025 Security Bulletin
- 2026-06-17 - Last updated in NVD database
Technical Details for CVE-2025-47357
Vulnerability Analysis
The vulnerability resides in the handling of QFPROM operations exposed to user-level drivers on affected Qualcomm chipsets. QFPROM (Qualcomm Fuse Programmable Read-Only Memory) stores hardware-level provisioning data including device identifiers, keys, and configuration bits. A user-level driver can invoke read or write operations against Fuse regions without proper authentication controls in place. This exposes sensitive data intended to remain confined to trusted execution contexts.
Because the attack vector is local and requires only low privileges without user interaction, any compromised or malicious user-space component with access to the driver interface can trigger the operation. The impact spans confidentiality, integrity, and availability, since Fuse writes to certain regions are irreversible and can permanently alter device state.
Root Cause
The root cause is missing authentication for a critical function ([CWE-306]). The affected driver path exposes QFPROM Fuse region read and write primitives to user-level callers without verifying that the caller is authorized to perform hardware-level Fuse operations. Fuse programming interfaces should be gated behind trusted execution environment (TEE) or bootloader-only paths.
Attack Vector
Exploitation requires local access with low privileges on the affected chipset. An attacker with the ability to load or interact with a user-level driver can issue QFPROM read requests to disclose sensitive fused values, or write requests to modify or blow Fuse bits. No user interaction is required, and the attack executes within the scope of the affected component.
No public proof-of-concept or exploit code has been published for CVE-2025-47357. See the Qualcomm November 2025 Security Bulletin for vendor technical details.
Detection Methods for CVE-2025-47357
Indicators of Compromise
- Unexpected user-space processes issuing ioctl or driver calls to QFPROM or Fuse-related device nodes
- Firmware attestation or secure boot integrity checks reporting Fuse value mismatches after boot
- Kernel or driver log entries referencing QFPROM read/write operations originating from non-privileged contexts
Detection Strategies
- Audit kernel and driver logs on affected Qualcomm platforms for QFPROM access events tied to user-level callers
- Baseline expected QFPROM interactions during boot and provisioning, and alert on runtime access outside these windows
- Correlate driver-level Fuse operations with process ancestry to identify unauthorized invocations
Monitoring Recommendations
- Enable verbose logging on affected driver subsystems that expose QFPROM interfaces
- Monitor firmware and platform integrity attestation results across fleets of automotive and connectivity devices using these Qualcomm chipsets
- Track deployment status of the November 2025 Qualcomm patches across OEM firmware images
How to Mitigate CVE-2025-47357
Immediate Actions Required
- Apply the Qualcomm-provided patches referenced in the November 2025 Security Bulletin as soon as OEMs release firmware updates
- Inventory affected chipset deployments including automotive (SA/QAM series) and connectivity (QCA series) platforms
- Restrict local access to devices running unpatched firmware, particularly systems where untrusted user-level drivers may be loaded
Patch Information
Qualcomm has released fixes as part of the November 2025 Security Bulletin. Device OEMs must integrate the updated firmware into their platform builds and distribute to end devices. See the Qualcomm November 2025 Security Bulletin for the full list of affected components and patch identifiers.
Workarounds
- Where patches are not yet available, restrict the ability to load or interact with user-level drivers that expose QFPROM interfaces
- Enforce least-privilege access controls on device nodes associated with Fuse operations
- Validate firmware integrity through secure boot and remote attestation to detect Fuse tampering
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
