Vulnerabilites related to Unisoc (Shanghai) Technologies Co., Ltd. - SL8521E/SL8521ET/ SL8541E/UIS8141E/UWS6137/UWS6137E/UWS6151(E)/UWS6152
CVE-2025-31715 (GCVE-0-2025-31715)
Vulnerability from cvelistv5
Published
2025-08-18 00:34
Modified
2025-08-18 16:09
Severity ?
9.8 (Critical) - CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
CWE
Summary
In vowifi service, there is a possible command injection due to improper input validation. This could lead to remote escalation of privilege with no additional execution privileges needed.
References
Impacted products
Vendor Product Version
Unisoc (Shanghai) Technologies Co., Ltd. SL8521E/SL8521ET/ SL8541E/UIS8141E/UWS6137/UWS6137E/UWS6151(E)/UWS6152 Version: Mocor5/Andorid8.1/Andorid9
 Create a notification for this product.
Show details on NVD website

To clipboard 

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2025-31715",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "yes"
                  },
                  {
                    "Technical Impact": "total"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2025-08-18T16:05:23.315610Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2025-08-18T16:09:44.247Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "SL8521E/SL8521ET/ SL8541E/UIS8141E/UWS6137/UWS6137E/UWS6151(E)/UWS6152",
          "vendor": "Unisoc (Shanghai) Technologies Co., Ltd.",
          "versions": [
            {
              "status": "affected",
              "version": "Mocor5/Andorid8.1/Andorid9"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In vowifi service, there is a possible command injection due to improper input validation. This could lead to remote escalation of privilege with no additional execution privileges needed."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 9.8,
            "baseSeverity": "CRITICAL",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "format": "CVSS",
          "scenarios": [
            {
              "lang": "en",
              "value": "GENERAL"
            }
          ]
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "description": "CWE-77 Improper Neutralization of Special Elements used in a Command (\u0027Command Injection\u0027)",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2025-08-18T00:34:30.378Z",
        "orgId": "63f92e9c-2193-4c24-98a9-93640392c3d3",
        "shortName": "Unisoc"
      },
      "references": [
        {
          "url": "https://www.unisoc.com/en_us/secy/announcementDetail/1944933773300793346"
        }
      ]
    }
  },
  "cveMetadata": {
    "assignerOrgId": "63f92e9c-2193-4c24-98a9-93640392c3d3",
    "assignerShortName": "Unisoc",
    "cveId": "CVE-2025-31715",
    "datePublished": "2025-08-18T00:34:30.378Z",
    "dateReserved": "2025-04-01T08:30:14.187Z",
    "dateUpdated": "2025-08-18T16:09:44.247Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

CVE-2025-31713 (GCVE-0-2025-31713)
Vulnerability from cvelistv5
Published
2025-08-18 00:34
Modified
2025-08-18 16:31
Severity ?
8.4 (High) - CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
CWE
Summary
In engineer mode service, there is a possible command injection due to improper input validation. This could lead to local escalation of privilege with no additional execution privileges needed.
References
Impacted products
Vendor Product Version
Unisoc (Shanghai) Technologies Co., Ltd. SL8521E/SL8521ET/ SL8541E/UIS8141E/UWS6137/UWS6137E/UWS6151(E)/UWS6152 Version: Mocor5/Andorid8.1
 Create a notification for this product.
Show details on NVD website

To clipboard 

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2025-31713",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "total"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2025-08-18T16:30:59.173187Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2025-08-18T16:31:07.724Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "SL8521E/SL8521ET/ SL8541E/UIS8141E/UWS6137/UWS6137E/UWS6151(E)/UWS6152",
          "vendor": "Unisoc (Shanghai) Technologies Co., Ltd.",
          "versions": [
            {
              "status": "affected",
              "version": "Mocor5/Andorid8.1"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In engineer mode service, there is a possible command injection due to improper input validation. This could lead to local escalation of privilege with no additional execution privileges needed."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 8.4,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "format": "CVSS",
          "scenarios": [
            {
              "lang": "en",
              "value": "GENERAL"
            }
          ]
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "description": "CWE-77 Improper Neutralization of Special Elements used in a Command (\u0027Command Injection\u0027)",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2025-08-18T00:34:28.435Z",
        "orgId": "63f92e9c-2193-4c24-98a9-93640392c3d3",
        "shortName": "Unisoc"
      },
      "references": [
        {
          "url": "https://www.unisoc.com/en_us/secy/announcementDetail/1944933773300793346"
        }
      ]
    }
  },
  "cveMetadata": {
    "assignerOrgId": "63f92e9c-2193-4c24-98a9-93640392c3d3",
    "assignerShortName": "Unisoc",
    "cveId": "CVE-2025-31713",
    "datePublished": "2025-08-18T00:34:28.435Z",
    "dateReserved": "2025-04-01T08:30:14.187Z",
    "dateUpdated": "2025-08-18T16:31:07.724Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

CVE-2025-31714 (GCVE-0-2025-31714)
Vulnerability from cvelistv5
Published
2025-08-18 00:34
Modified
2025-08-18 16:22
Severity ?
6.8 (Medium) - CVSS:3.1/AV:P/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
CWE
Summary
In Developer Tools, there is a possible missing verification incorrect input. This could lead to local escalation of privilege with no additional execution privileges needed.
References
Impacted products
Vendor Product Version
Unisoc (Shanghai) Technologies Co., Ltd. SL8521E/SL8521ET/ SL8541E/UIS8141E/UWS6137/UWS6137E/UWS6151(E)/UWS6152 Version: Mocor5/Andorid8.1/Andorid9
 Create a notification for this product.
Show details on NVD website

To clipboard 

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2025-31714",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "total"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2025-08-18T16:14:12.882706Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2025-08-18T16:22:50.535Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "SL8521E/SL8521ET/ SL8541E/UIS8141E/UWS6137/UWS6137E/UWS6151(E)/UWS6152",
          "vendor": "Unisoc (Shanghai) Technologies Co., Ltd.",
          "versions": [
            {
              "status": "affected",
              "version": "Mocor5/Andorid8.1/Andorid9"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In Developer Tools, there is a possible missing verification incorrect input. This could lead to local escalation of privilege with no additional execution privileges needed."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 6.8,
            "baseSeverity": "MEDIUM",
            "vectorString": "CVSS:3.1/AV:P/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "format": "CVSS",
          "scenarios": [
            {
              "lang": "en",
              "value": "GENERAL"
            }
          ]
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "description": "CWE-20 Improper Input Validation",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2025-08-18T00:34:29.399Z",
        "orgId": "63f92e9c-2193-4c24-98a9-93640392c3d3",
        "shortName": "Unisoc"
      },
      "references": [
        {
          "url": "https://www.unisoc.com/en_us/secy/announcementDetail/1944933773300793346"
        }
      ]
    }
  },
  "cveMetadata": {
    "assignerOrgId": "63f92e9c-2193-4c24-98a9-93640392c3d3",
    "assignerShortName": "Unisoc",
    "cveId": "CVE-2025-31714",
    "datePublished": "2025-08-18T00:34:29.399Z",
    "dateReserved": "2025-04-01T08:30:14.187Z",
    "dateUpdated": "2025-08-18T16:22:50.535Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}