CVE-2025-65885
📋 TL;DR
This vulnerability allows local attackers to inject startup scripts via crafted .txt files in the Data directory on Nokia Symbian Belle devices running Delight Custom Firmware. Attackers can execute arbitrary code during system startup, potentially gaining persistent access. Only users of specific Nokia devices with Delight CFW installed are affected.
💻 Affected Systems
- Delight Custom Firmware for Nokia Symbian Belle devices
📦 What is this software?
⚠️ Risk & Real-World Impact
Worst Case
Complete device compromise with persistent backdoor installation, allowing attackers to steal sensitive data, monitor user activity, or use device as part of botnet.
Likely Case
Local privilege escalation leading to unauthorized access to device functions and user data, potentially installing malware that persists across reboots.
If Mitigated
Limited impact if devices are not shared and users don't install untrusted files, though risk remains from malware or malicious apps.
🎯 Exploit Status
Exploit requires creating specific .txt files in Data directory; trivial for attackers with file system access. Proof-of-concept details available in public references.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: None
Vendor Advisory: https://www.symwld.com/delight/
Restart Required: No
Instructions:
No official patch available. Consider removing Delight CFW and returning to stock firmware, or apply workarounds below.
🔧 Temporary Workarounds
Restrict Data directory permissions
allPrevent unauthorized write access to the Data directory where .txt files are processed
chmod 700 /Data (or equivalent on Symbian)
Monitor for suspicious .txt files
allRegularly check Data directory for unexpected .txt files and remove them
ls -la /Data/*.txt
rm /Data/suspicious.txt
🧯 If You Can't Patch
- Discontinue use of Delight CFW and revert to stock Symbian Belle firmware
- Implement strict physical security controls and avoid sharing devices
🔍 How to Verify
Check if Vulnerable:
Check if Delight CFW is installed and examine Data directory for unexpected .txt files with startup script contentCheck Version:
Check device settings or firmware info for 'Delight' versionVerify Fix Applied:
Verify Data directory permissions are restricted and no unauthorized .txt files exist📡 Detection & Monitoring
Log Indicators:
- Unexpected file creation in Data directory
- Suspicious startup script execution
Network Indicators:
- None - local exploit only
SIEM Query:
File creation events in Data directory with .txt extension on Symbian devices