What is the CVSS score of EUVD-2025-16701?

EUVD-2025-16701 has a CVSS 3.1 base score of 7.8 (High). CVSS vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.0%.

Which versions of Fastconnect 6700 Firmware are affected by EUVD-2025-16701?

CVE-2025-27031 is a high-severity memory corruption vulnerability affecting systems processing IOCTL commands in write loopback mode, potentially allowing attackers to execute arbitrary code or cause…

How to fix or mitigate EUVD-2025-16701?

Within 24 hours: Identify and inventory all systems running affected software/hardware versions and isolate critical systems from untrusted networks. Within 7 days: Implement compensating controls including network segmentation, disable write loopback mode if operationally feasible, and apply monitoring rules to detect exploitation attempts. Within 30 days: Establish a vendor contact plan to obtain and test patches when released, and conduct a risk assessment to prioritize remediation for systems that cannot be isolated.

Fastconnect 6700 Firmware EUVD-2025-16701

| CVE-2025-27031 HIGH

Use After Free (CWE-416)

2025-06-03 product-security@qualcomm.com

Denial Of Service Use After Free Memory Corruption Fastconnect 6700 Firmware Fastconnect 6900 Firmware Fastconnect 7800 Firmware Qcm5430 Firmware Qcm6490 Firmware Qcs5430 Firmware Qcs6490 Firmware Sc8380xp Firmware Video Collaboration Vc3 Platform Firmware Wcd9370 Firmware Wcd9375 Firmware Wcd9380 Firmware Wcd9385 Firmware Wsa8830 Firmware Wsa8835 Firmware Wsa8840 Firmware Wsa8845 Firmware Wsa8845h Firmware

7.8

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

7.8 HIGH

AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Attack Vector

Local

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

EUVD ID Assigned

Mar 14, 2026 - 17:04 euvd

EUVD-2025-16701

Analysis Generated

Mar 14, 2026 - 17:04 vuln.today

CVE Published

Jun 03, 2025 - 06:15 nvd

HIGH 7.8

DescriptionCVE.org

memory corruption while processing IOCTL commands, when the buffer in write loopback mode is accessed after being freed.

AnalysisAI

Use-after-free memory corruption vulnerability in IOCTL command processing that occurs when buffers in write loopback mode are accessed after being freed. This local privilege escalation affects authenticated users (PR:L) on affected systems and can enable attackers to achieve confidentiality, integrity, and availability compromise (C:H/I:H/A:H). The vulnerability requires local access and low complexity exploitation, making it a significant risk for multi-user systems or systems where local code execution is possible.

Technical ContextAI

This vulnerability is classified as CWE-416 (Use After Free), a memory safety issue where freed memory is dereferenced during IOCTL (Input/Output Control) command handling. The specific context involves write loopback mode operations, suggesting a device driver or kernel subsystem that manages buffered I/O operations. The use-after-free occurs in a code path where buffer lifecycle management is flawed—likely a buffer is freed prematurely or reference counting is incorrect, while subsequent IOCTL operations still attempt to access it. This pattern is common in device drivers for storage, network, or specialized hardware interfaces where loopback testing modes are implemented. The attack surface is limited to local authenticated users with appropriate privileges to issue IOCTL commands, but the memory corruption can lead to arbitrary code execution in kernel space depending on heap layout and exploitation technique.

RemediationAI

Primary remediation is to apply the security patch released by the affected vendor. Without specific vendor references provided, follow these general steps: (1) Check vendor security advisories for CVE-2025-27031 patches and patch version numbers; (2) For Linux distributions, check package repositories for kernel or driver updates and apply via package manager (apt, yum, dnf, etc.); (3) For Windows, check Windows Update or vendor-specific driver update tools; (4) Test patches in non-production environments before broad deployment. Interim mitigations pending patch availability: (1) Restrict local user access to IOCTL-issuing mechanisms where possible; (2) Disable loopback mode functionality if not required; (3) Apply principle of least privilege to limit who can access affected driver interfaces; (4) Monitor for suspicious IOCTL activity in security logs. Workarounds are limited for use-after-free in kernel code; patching is the reliable solution.