Qualcomm Chipset Firmware CVE-2025-47357

Exploitation requires local, user-level access to a device running affected Qualcomm firmware AND the ability to invoke a user-level driver that performs QFPROM read or write operations on Fuse regions - the root cause (CWE-306) is missing authentication/authorization enforcement on that QFPROM access path. Limiting factors that reduce real-world risk: the attacker must already have local user-level privileges (PR:L, AV:L) and driver access on the device; there is no remote or unauthenticated path and no network exposure; exploitation is confined to the specific listed Qualcomm SoC/firmware families (automotive QAM/SA/QCS, connectivity QCA, server SRV), not general-purpose systems.

Signals point consistently to a LOCAL, lower-urgency issue rather than a mass-exploitation priority. The provided CVSS 3.1 vector (AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H, base 7.8 HIGH) establishes that exploitation requires local access with low privileges (PR:L) - consistent with the description's reference to 'a user-level driver' performing the QFPROM operations. EPSS is 0.02% (5th percentile), indicating essentially negligible predicted exploitation activity, and there is no CISA KEV listing and no public exploit identified, so there is no evidence of active exploitation. No SSVC decision data was provided in the input. Note a tension worth flagging: the vulnerability is titled 'Information Disclosure' and tagged as such, yet the CVSS vector asserts High Integrity and High Availability impact in addition to Confidentiality - plausible because QFPROM/Fuse write operations can permanently alter one-time-programmable hardware configuration, but verify the full I/A impact against the Qualcomm November 2025 bulletin. The affected products are Qualcomm automotive/embedded/connectivity firmware (QAM/SA/QCS automotive SoCs, QCA Wi-Fi/connectivity, SRV server parts), so realistic risk is scoped to attackers who already have a foothold with user-level driver access on those specific devices.

An attacker who already has user-level code execution on a device built on an affected Qualcomm chipset invokes a user-level driver to perform QFPROM read (or write) operations against Fuse regions that should be access-restricted, disclosing sensitive fuse-stored data (and potentially corrupting fuse state). Because the attack vector is local (AV:L) with low privileges (PR:L) and no user interaction, it is a local privilege/boundary bypass rather than a remote attack; no public proof-of-concept exploit was identified at the time of analysis.