CVE ID | CVE-2025-2762 |
CVSS SCORE | 7.8, AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H |
AFFECTED VENDORS |
CarlinKit |
AFFECTED PRODUCTS |
CPC200-CCPA |
VULNERABILITY DETAILS |
This vulnerability allows local attackers to escalate privileges on affected installations of CarlinKit CPC200-CCPA devices. An attacker must first obtain the ability to execute low-privileged code on the target system in order to exploit this vulnerability. The specific flaw exists within the configuration of the application system-on-chip (SoC). The issue results from the lack of a properly configured hardware root of trust. An attacker can leverage this vulnerability to escalate privileges and execute arbitrary code in the context of the boot process. |
ADDITIONAL DETAILS |
06/05/24 – ZDI contacted the vendor’s support team via email |
DISCLOSURE TIMELINE |
|
CREDIT | Aaron Luo and Spencer Hsieh of VicOne |