Delight Custom Firmware
CVE-2025-65885
MEDIUM
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessGain local access to device :\Data directory
-
DeliveryWrite crafted .txt startup script
-
ExploitFirmware parses file at boot
-
ExecutionInject and execute arbitrary commands
-
ImpactPersistent device compromise
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A05:2025 - Injection
ASVS 5.0
V1 - Encoding and Sanitization Command injection prevention
MITRE ATT&CK
1 technique across 1 tactic: Execution The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Requires local write access to the device's :\Data directory on a device running Delight Custom Firmware; the attacker places a crafted .txt file that the firmware's startup mechanism parses and executes as a boot script. Exploitation is LIMITED by: (1) the need for local/physical or file-system-level access (no network path), typically via USB mass-storage mode or an on-device file manager; (2) a device reboot to trigger execution of the injected startup script; and (3) the affected software being niche custom firmware on long-discontinued Symbian Belle hardware. There is no default-remote exposure. |
| Impact | Real-world risk is LOW-to-MODERATE despite the CWE-77 command injection classification. The CVSS vector (CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N, base 5.1) is internally consistent and tells the dominant story: AV:L means exploitation requires local access to the device's :\Data filesystem, which eliminates remote mass exploitation. No EPSS score, no CISA KEV listing, and no explicitly flagged POC were supplied in the input, so there is no signal of active or widespread exploitation. The two references (a researcher gist by 'symbuzzer' and the symwld.com Delight project page) suggest a security-researcher disclosure rather than opportunistic attacker interest. Signals are therefore aligned, not conflicting - low real-world urgency driven by the local attack vector and an extinct hardware/OS platform. One caveat worth flagging: the NVD-assigned impacts (C:L/I:L/A:N) likely UNDERSTATE the technical impact, because injecting startup scripts yields arbitrary command execution at boot, which in practice can fully compromise the device; verify the impact metrics against the researcher writeup. This is a niche-platform local-privilege/persistence issue, not an internet-facing priority. |
| Exploit ScenarioDerived | An attacker with physical or local file-system access to a Delight CFW Nokia device (e.g., via USB mass-storage mode or an on-device file manager) writes a crafted .txt file into the :\Data directory. On the next boot the firmware parses that file as a startup script and executes the attacker's injected commands, giving persistent code execution on the device. No public exploit is confirmed in the input, though a researcher gist is referenced and may contain technical steps. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Oct 13, 2026
Command injection in the Delight Custom Firmware (CFW) for Nokia Symbian Belle devices lets a local attacker place a crafted .txt file in the device's :\Data directory that the firmware's startup mechanism parses and executes as a boot script, yielding code execution at boot. All affected builds are covered - Delight v1.8 on the Nokia 808, v6.7 on the N8 and C7, v1.3 on the E7, v1.2 on the 700 and 500, v1.1 on the 701, and v1.0 on the 603, E6, Oro, and Vertu Constellation T. Exploitation is unauthenticated but strictly local: it requires write access to :\Data (typically via USB mass-storage mode or an on-device file manager) plus a device reboot to trigger the injected script, and no public exploit code or active exploitation has been identified at time of analysis. NVD scores this 5.1 (CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N), while this assessment rates the impact higher (C:H/I:H/A:H) given that boot-script execution runs with firmware privileges; real-world risk remains LOW-to-MODERATE because the affected platform is long-discontinued, niche custom firmware with no default remote exposure.
RemediationAI
No vendor-released patch was identified at time of analysis, and no fixed Delight CFW version is documented in the available references (https://www.symwld.com/delight/ and https://gist.github.com/symbuzzer/3315e88adc2bba0b6cc66d192b49546d), so remediation depends on compensating controls. The most effective step is to prevent untrusted content from reaching the :\Data directory: do not leave the device in USB mass-storage mode when connected to untrusted hosts, and avoid copying files onto the device from unverified sources; the trade-off is reduced convenience for sideloading content. Restrict access to the :\Data partition so that only trusted on-device software and trusted operators can write to it, and inspect the directory for unexpected .txt startup files, removing any that are not recognized - though a compromised boot script may already have executed, so this is detection rather than prevention. Because execution requires a reboot, deferring or avoiding unnecessary reboots limits the window only marginally and is not a real mitigation. For users who do not depend on Delight-specific features, reflashing to stock Symbian Belle firmware removes the vulnerable custom startup logic entirely, at the cost of losing all Delight CFW customizations. An additional consideration is that the affected hardware is discontinued and receives no ongoing security maintenance, so treating these devices as untrusted for any sensitive use is advisable.
Affects your stack
Find out whether the stacks and servers you run are on an affected version.
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The root cause is CWE-77 (Improper Neutralization of Special Elements used in a Command), i.e. classic command injection exposed through an insecure firmware startup workflow. Symbian Belle stores per-device and per-user configuration under the writable :\Data directory, and Delight CFW's boot/startup logic consumes plain .txt files from that location, treating their contents as executable startup directives. Because the parser does not sanitize or authenticate the input, any party able to drop a file into :\Data can effectively plant a script that is executed with firmware-level privileges on the next boot. The CPE data confirms the affected software package is symwld:delight_custom_firmware across versions 1.0, 1.1, 1.2, 1.3, 6.7 and 1.8, which map to the specific device/firmware pairings in the advisory (Nokia 808, N8, E7, C7, 700, 701, 603, 500, E6, Oro, and Vertu Constellation T). No network protocol or remote service is involved; the attack surface is the writable data partition reached over local interfaces such as USB mass storage or an on-device file manager.
Know when Delight Custom Firmware gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:L/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N
Local write to a user-accessible :\Data directory needs no privileges (PR:N, AV:L), and startup-script injection yields arbitrary boot-time command execution, so C/I/A are High - higher than NVD's Low impacts.
Primary rating from Vendor (mitre).
CVSS VectorVendor: mitre
DescriptionCVE.org
An issue was discovered in the Delight Custom Firmware (CFW) for Nokia Symbian Belle devices on Nokia 808 (Delight v1.8), Nokia N8 (Delight v6.7), Nokia E7 (Delight v1.3), Nokia C7 (Delight v6.7), Nokia 700 (Delight v1.2), Nokia 701 (Delight v1.1), Nokia 603 (Delight v1.0), Nokia 500 (Delight v1.2), Nokia E6 (Delight v1.0), Nokia Oro (Delight v1.0), and Vertu Constellation T (Delight v1.0) allowing local attackers to inject startup scripts via crafted .txt files in the :\Data directory.
Threat Intelligence Overview
NVD
CVE.org
EPSS
GitHub
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
OS command injection occurs when an application passes unsanitized user input directly into system shell commands.
Exploit-DB