CVE-2025-21435: High Severity Vulnerability in qca-wifi-host-cmn Package
Summary
CVE-2025-21435: ... Affects platform/vendor/qcom-opensource/wlan/qca-wifi-host-cmn versions >= SoCVersion:0, < SoCVersion:2025-04-05. Fixed in SoCVersion:2025-04-05. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
Background
The qca-wifi-host-cmn package is a component of the Qualcomm open-source WLAN driver for Android devices. It facilitates wireless communication and connectivity features in Android systems. This package is crucial for enabling Wi-Fi functionalities, ensuring devices can connect to wireless networks effectively. However, vulnerabilities in this package can lead to significant security risks, potentially exposing devices to unauthorized access or data breaches.
Vulnerability Detail
CVE-2025-21435 is a high-severity vulnerability found in the qca-wifi-host-cmn package. The vulnerability originates from improper handling of certain functions within the WLAN scanning utilities, specifically in the 'util_gen_new_ie' function. This flaw could allow attackers to exploit the scanning process, leading to unauthorized access or manipulation of wireless connections. The potential ramifications include data leakage, unauthorized network access, and overall compromise of device security.
How To Fix
Minimum fixed version
SoCVersion:2025-04-05
This is the first release that contains the fix.
Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, users can disable the WLAN scanning feature until the package is updated. This can be done by modifying the device's Wi-Fi settings to prevent automatic scanning for networks.
Conclusion
The CVE-2025-21435 vulnerability in the qca-wifi-host-cmn package poses significant security risks to Android devices. It is crucial for users to update their packages to the patched version to mitigate these risks. Utilizing tools like Vulert can help monitor and alert for such vulnerabilities in real-time.
See every vulnerability recorded for platform/vendor/qcom-opensource/wlan/qca-wifi-host-cmn →
FAQ
CVE-2025-21435 is a high-severity vulnerability in the qca-wifi-host-cmn package that could allow unauthorized access to wireless networks.
You can use the Vulert playground at Vulert Scanner to check if your application is affected by this vulnerability without needing to sign up.
The risks include potential data leakage, unauthorized access to networks, and compromise of device security.
You can update the package by executing 'git pull origin master' and 'git checkout 5c4757fa56e39e217064ae44d1d91c7ea0ba2b7e' in your project directory.
Yes, you can disable the WLAN scanning feature in your device's Wi-Fi settings as a temporary workaround.
References
Related vulnerabilities
Recent vulnerabilities recorded for platform/vendor/qcom-opensource/wlan/qca-wifi-host-cmn.
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
