PT-2025-25573 · Google · Chrome Os

CVE-2025-6177 · Publicado 2024-12-06 · Atualizado 2025-06-16

Positive Technologies (AI Summary)

CVSS v3.1

7.4

Alta

Vetor base

AV:L/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Google ChromeOS versions 16063.45.2 and potentially others

Description The issue allows a local attacker to gain root code execution via exploiting a debug shell accessible through specific key combinations during developer mode entry and MiniOS access. This can occur even when developer mode is blocked by device policy or Firmware Write Protect.

Recommendations For version 16063.45.2 and potentially others, as a temporary workaround, consider disabling access to the debug shell until a patch is available. Restrict access to the MiniOS to minimize the risk of exploitation. Avoid using the specific key combinations that allow access to the debug shell during developer mode entry.

Correção

LPE

Improper Privilege Management

Enumeração de Fraquezas

CWE-269

Identificadores relacionados

BDU:2025-09935

CVE-2025-6177

Produtos afetados

Chrome Os

Referências · 11

• https://issues.chromium.org/issues/b/382540412 · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2025-6177 · Nota de Segurança
• https://issuetracker.google.com/issues/382540412?pli=1 · Nota
• https://twitter.com/CVEnew/status/1934654691628982568 · Publicação no Twitter
• https://osv.dev/vulnerability/CVE-2025-6177 · Aviso do Fabricante
• https://issuetracker.google.com/issues/382540412 · Nota
• https://t.me/cvenotify/125832 · Publicação no Telegram
• https://t.me/cvetracker/26336 · Publicação no Telegram
• https://t.me/latest_high_impact_cve/2678 · Publicação no Telegram
• https://bdu.fstec.ru/vul/2025-09935 · Nota de Segurança
• https://twitter.com/VulmonFeeds/status/1934681999198880030 · Publicação no Twitter