总结

细节

CVE ID CVE-2025-31712
标题 Buffer Copy without Checking Size of Input ('Classic Buffer Overflow') in cplog service
漏洞描述
In cplog service, there is a possible out of bounds write due to a missing bounds check. This could lead to local denial of service with no additional execution privileges needed.
技术领域 Android
漏洞类型 CWE-120 Buffer Copy without Checking Size of Input
攻击途径 Local
CVSS 等级 Medium
CVSS 分数 5.1
CVSS 评分 CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L
影响芯片*
SC7731E/SC9832E/SC9863A/T310/T606/T612/T616/T610/T618/T750/T765/T760/T770/T820/S8000/T8300/T9300
影响软件版本
Android13/Android14/Android15

CVE ID CVE-2025-31711
标题 NULL Pointer Dereference in cplog service
漏洞描述
In cplog service, there is a possible system crash due to null pointer dereference. This could lead to local denial of service with no additional execution privileges needed.
技术领域 Android
漏洞类型 CWE-476 NULL Pointer Dereference
攻击途径 Local
CVSS 等级 Medium
CVSS 分数 5.1
CVSS 评分 CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L
影响芯片*
SC7731E/SC9832E/SC9863A/T310/T606/T612/T616/T610/T618/T750/T765/T760/T770/T820/S8000/T8300/T9300
影响软件版本
Android13/Android14/Android15

CVE ID CVE-2025-31710
标题 Improper Neutralization of Special Elements used in a Command ('Command Injection') in engineermode service
漏洞描述
In engineermode service, there is a possible command injection due to improper input validation. This could lead to local escalation of privilege with no additional execution privileges needed.
技术领域 Android
漏洞类型 CWE-77 Improper Neutralization of Special Elements used in a Com
攻击途径 Local
CVSS 等级 Medium
CVSS 分数 5.9
CVSS 评分 CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L
影响芯片*
SC9863A/T606/T612/T616/T750/T765/T760/T770/T820/S8000/T8300/T9300
影响软件版本
Android13/Android14/Android15

*受影响芯片组列表可能不完整。如需了解最新信息，OEM可直接访问 https://unisupport.unisoc.com

漏洞类型定义

版本