All CISA Advisories, EN

Universal Boot Loader (U-Boot)

View CSAF

1. EXECUTIVE SUMMARY

  • CVSS v4 8.6
  • ATTENTION: Low attack complexity
  • Vendor: U-Boot
  • Equipment: U-Boot
  • Vulnerability: Improper Access Control for Volatile Memory Containing Boot Code

2. RISK EVALUATION

Successful exploitation of this vulnerability could result in arbitrary code execution.

3. TECHNICAL DETAILS

3.1 AFFECTED PRODUCTS

The following version of U-boot is affected:

  • U-boot: All versions prior to 2017.11

The following specific chips have been confirmed to be affected:

  • Qualcomm IPQ4019
  • Qualcomm IPQ5018
  • Qualcomm IPQ5322
  • Qualcomm IPQ6018
  • Qualcomm IPQ8064
  • Qualcomm IPQ8074
  • Qualcomm IPQ9574

3.2 VULNERABILITY OVERVIEW

3.2.1 IMPROPER ACCESS CONTROL FOR VOLATILE MEMORY CONTAINING BOOT CODE CWE-1274

The affected products are vulnerable to a bootloader vulnerability, which could allow an attacker to execute arbitrary code.

CVE-2025-24857 has been assigned to this vulnerability. A CVSS v3 base score of 8.4 has been calculated; the CVSS vector string is (AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H).

A CVSS v4 score has also been calculated for CVE-2025-24857. A base score of 8.6 has been calculated; the CVSS vector string is (AV:L/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N).

3.3 BACKGROUND