CVE-2025-47345
Published: 07 January 2026
Summary
CVE-2025-47345 is a high-severity Reusing a Nonce, Key Pair in Encryption (CWE-323) vulnerability in Qualcomm Wcd9385 Firmware. Its CVSS base score is 8.4 (High).
Operationally, exploitation aligns with the MITRE ATT&CK technique Exploitation for Privilege Escalation (T1068); ranked at the 1.8th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.
The strongest mitigations our analysis identified are NIST 800-53 SC-13 (Cryptographic Protection) and SC-28 (Protection of Information at Rest).
Deeper analysis
CVE-2025-47345 is a cryptographic vulnerability that may occur while encrypting license data in Qualcomm products. Published on 2026-01-07, it carries a CVSS v3.1 base score of 8.4 (AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:N) and maps to CWE-323.
A local attacker with low privileges can exploit this issue with low attack complexity and no user interaction. Exploitation enables high impacts on confidentiality and integrity, with a scope change to high.
Qualcomm's January 2026 security bulletin details the vulnerability and associated mitigations at https://docs.qualcomm.com/product/publicresources/securitybulletin/january-2026-bulletin.html.
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2026-1242
Vulnerability details
Cryptographic issue may occur while encrypting license data.
- CWE(s)
Related Threats
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
Local crypto flaw (nonce/key reuse) in license encryption yields scope-changing high C/I impact from low privs, enabling exploitation for privilege escalation.
CVEs Like This One
Affected Assets
Mitigating Controls
Mitigating Controls (NIST 800-53 r5) AI
Directly requires identification, reporting, and correction of the specific cryptographic flaw in license data encryption, preventing exploitation of CVE-2025-47345.
Mandates implementation of appropriate cryptographic mechanisms to protect license data confidentiality and integrity against the vulnerability during encryption.
Requires cryptographic protection of information at rest, including license data, to comprehensively mitigate confidentiality and integrity impacts from the encryption flaw.