总结

细节

CVE ID CVE-2025-31715
标题 Improper Neutralization of Special Elements used in a Command ('Command Injection') in vowifi service
漏洞描述
In vowifi service, there is a possible command injection due to improper input validation. This could lead to remote escalation of privilege with no additional execution privileges needed.
技术领域 Android
漏洞类型 CWE-77 Improper Neutralization of Special Elements used in a Com
攻击途径 Network
CVSS 等级 Critical
CVSS 分数 9.8
CVSS 评分 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
影响芯片*
SL8521E/SL8521ET/ SL8541E/UIS8141E/UWS6137/UWS6137E/UWS6151(E)/UWS6152
影响软件版本
Mocor5/Andorid8.1/Andorid9

CVE ID CVE-2025-31714
标题 Improper Input Validation in Developer Tools
漏洞描述
In Developer Tools, there is a possible missing verification incorrect input. This could lead to local escalation of privilege with no additional execution privileges needed.
技术领域 Android
漏洞类型 CWE-20 Improper Input Validation
攻击途径 Physical
CVSS 等级 Medium
CVSS 分数 6.8
CVSS 评分 CVSS:3.1/AV:P/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
影响芯片*
SL8521E/SL8521ET/ SL8541E/UIS8141E/UWS6137/UWS6137E/UWS6151(E)/UWS6152
影响软件版本
Mocor5/Andorid8.1/Andorid9

CVE ID CVE-2025-31713
标题 Improper Neutralization of Special Elements used in a Command ('Command Injection') in engineer mode service
漏洞描述
In engineer mode service, there is a possible command injection due to improper input validation. This could lead to local escalation of privilege with no additional execution privileges needed.
技术领域 Android
漏洞类型 CWE-77 Improper Neutralization of Special Elements used in a Com
攻击途径 Local
CVSS 等级 High
CVSS 分数 8.4
CVSS 评分 CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
影响芯片*
SL8521E/SL8521ET/ SL8541E/UIS8141E/UWS6137/UWS6137E/UWS6151(E)/UWS6152
影响软件版本
Mocor5/Andorid8.1

*受影响芯片组列表可能不完整。如需了解最新信息，OEM可直接访问 https://unisupport.unisoc.com

漏洞类型定义

版本