CVE-2025-67264
Published: 23 January 2026
Summary
CVE-2025-67264 is a high-severity OS Command Injection (CWE-78) vulnerability in Doogee Note59 Pro\+ Firmware. Its CVSS base score is 7.8 (High).
Operationally, exploitation aligns with the MITRE ATT&CK technique Exploitation for Privilege Escalation (T1068); ranked at the 7.2th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog; a public proof-of-concept is referenced.
The strongest mitigations our analysis identified are NIST 800-53 SI-10 (Information Input Validation) and SI-2 (Flaw Remediation).
Deeper analysis
CVE-2025-67264 is an OS command injection vulnerability (CWE-78) in the com.sprd.engineermode component affecting Doogee Note59, Note59 Pro, and Note59 Pro+ smartphones. Published on 2026-01-23, the issue arises from incomplete patching of CVE-2025-31710 and carries a CVSS v3.1 base score of 7.8 (AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H). It enables local attackers to execute arbitrary code and escalate privileges via the EngineerMode ADB shell.
A local attacker with low privileges (PR:L) can exploit the vulnerability with low attack complexity and no user interaction. Exploitation grants the ability to inject and execute arbitrary OS commands through the ADB shell, resulting in high impacts to confidentiality, integrity, and availability, including full privilege escalation on the affected device.
Mitigation details are available in vendor advisories at http://doogee.com and further technical analysis, including potential patches or workarounds, at https://github.com/Skorpion96/unisoc-su/blob/main/CVE-2025-67264.md.
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2026-4237
Vulnerability details
An OS command injection vulnerability in the com.sprd.engineermode component in Doogee Note59, Note59 Pro, and Note59 Pro+ allows a local attacker to execute arbitrary code and escalate privileges via the EngineerMode ADB shell, due to incomplete patching of CVE-2025-31710
- CWE(s)
Related Threats
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
OS command injection (CWE-78) directly enables arbitrary Unix shell command execution via ADB and local privilege escalation on the device.
CVEs Like This One
Affected Assets
Mitigating Controls
Mitigating Controls (NIST 800-53 r5) AI
Directly addresses the incomplete patching of CVE-2025-31710 by requiring timely identification, prioritization, and remediation of system flaws.
Prevents OS command injection in the EngineerMode ADB shell by validating all information inputs for correctness, completeness, and context.
Limits the impact of privilege escalation from the command injection by employing explicit least privilege principles for the com.sprd.engineermode component.