CVE-2025-27064
📋 TL;DR
This vulnerability allows information disclosure through the diagHal interface when registering commands from clients. It affects Qualcomm devices using the vulnerable diag component, potentially exposing sensitive system information to unauthorized actors.
💻 Affected Systems
- Qualcomm chipsets with diagHal component
📦 What is this software?
Immersive Home 3210 Platform Firmware by Qualcomm
View all CVEs affecting Immersive Home 3210 Platform Firmware →
Immersive Home 326 Platform Firmware by Qualcomm
View all CVEs affecting Immersive Home 326 Platform Firmware →
Snapdragon 8 Gen 1 Mobile Platform Firmware by Qualcomm
View all CVEs affecting Snapdragon 8 Gen 1 Mobile Platform Firmware →
⚠️ Risk & Real-World Impact
Worst Case
An attacker could gain access to sensitive system information, debug data, or proprietary Qualcomm diagnostic information that could be used for further attacks or reverse engineering.
Likely Case
Information leakage of diagnostic data, potentially including device state, configuration details, or debugging information that shouldn't be accessible to unprivileged users.
If Mitigated
Limited exposure of non-critical diagnostic information with proper access controls and monitoring in place.
🎯 Exploit Status
Exploitation likely requires access to diagnostic interfaces and understanding of diag command structure. No public exploit details available.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: November 2025 security patch or later
Vendor Advisory: https://docs.qualcomm.com/product/publicresources/securitybulletin/november-2025-bulletin.html
Restart Required: Yes
Instructions:
1. Check with device manufacturer for November 2025 security patch availability. 2. Apply the security patch through standard OTA update process. 3. Reboot device after patch installation.
🔧 Temporary Workarounds
Disable diagnostic interfaces
allRestrict access to diag interfaces if not required for normal operation
Access control hardening
allImplement strict access controls on diagnostic services and interfaces
🧯 If You Can't Patch
- Implement network segmentation to isolate devices with diagnostic interfaces
- Monitor and log all access to diagnostic services and interfaces
🔍 How to Verify
Check if Vulnerable:
Check device security patch level - if before November 2025, likely vulnerable. Check with manufacturer for specific device vulnerability status.Check Version:
On Android: Settings > About phone > Android version > Security patch levelVerify Fix Applied:
Verify security patch level is November 2025 or later. Check with manufacturer confirmation that this CVE is addressed in the applied patch.📡 Detection & Monitoring
Log Indicators:
- Unauthorized access attempts to diag services
- Unexpected diag command registrations
- Diagnostic interface access from unauthorized users
Network Indicators:
- Unexpected traffic to diagnostic ports
- Diag protocol usage from unexpected sources
SIEM Query:
Search for events related to diag service access, diagnostic interface usage, or Qualcomm diagnostic protocol activity