CVE-2025-67264
📋 TL;DR
A local OS command injection vulnerability in the com.sprd.engineermode component on Doogee Note59 series devices allows attackers with ADB shell access to execute arbitrary commands and escalate privileges. This affects Doogee Note59, Note59 Pro, and Note59 Pro+ smartphones. The vulnerability results from incomplete patching of a previous vulnerability (CVE-2025-31710).
💻 Affected Systems
- Doogee Note59
- Doogee Note59 Pro
- Doogee Note59 Pro+
📦 What is this software?
⚠️ Risk & Real-World Impact
Worst Case
Complete device compromise with root privileges, allowing installation of persistent malware, data theft, and device control.
Likely Case
Local privilege escalation from limited user to root/system privileges, enabling unauthorized access to sensitive data and system functions.
If Mitigated
Limited impact if ADB debugging is disabled and physical access is restricted.
🎯 Exploit Status
Exploit requires ADB shell access. Public proof-of-concept available on GitHub. Similar to previously patched CVE-2025-31710.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: Unknown
Vendor Advisory: http://doogee.com
Restart Required: Yes
Instructions:
1. Check Doogee website for security updates. 2. Install any available firmware updates. 3. If no patch available, apply workarounds.
🔧 Temporary Workarounds
Disable ADB Debugging
androidPrevents local attackers from accessing ADB shell required for exploitation
Settings > Developer Options > USB Debugging (toggle OFF)
Disable EngineerMode Component
androidRemove or disable the vulnerable com.sprd.engineermode component
adb shell pm disable-user --user 0 com.sprd.engineermode
🧯 If You Can't Patch
- Disable USB debugging in developer options
- Restrict physical access to devices
- Monitor for suspicious ADB connections
🔍 How to Verify
Check if Vulnerable:
Check if com.sprd.engineermode component is present and EngineerMode ADB shell is accessibleCheck Version:
adb shell getprop ro.build.display.idVerify Fix Applied:
Verify com.sprd.engineermode component is removed/disabled or ADB debugging is disabled📡 Detection & Monitoring
Log Indicators:
- ADB shell access attempts
- EngineerMode component execution
- Privilege escalation attempts
Network Indicators:
- ADB over network connections
- Unexpected USB debugging sessions
SIEM Query:
source="android_logs" AND ("EngineerMode" OR "com.sprd.engineermode" OR "ADB shell")