PT-2025-20043 · Unknown · Unifiedwfc

011100101001 · Published 2025-05-07 · Updated 2025-05-07 · CVE-2025-20958

Positive Technologies (AI Summary)

CVSS v3.1

4.4

Medium

Base vector

AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:L

Name of the Vulnerable Software and Affected Versions UnifiedWFC versions prior to SMR May-2025 Release 1

Description The issue is related to improper verification of intent by a broadcast receiver, allowing local attackers to manipulate VoWiFi related behaviors. This could potentially be exploited by attackers to alter the expected functionality of VoWiFi.

Recommendations For UnifiedWFC versions prior to SMR May-2025 Release 1, update to SMR May-2025 Release 1 or later to resolve the issue. As a temporary workaround, consider restricting access to the broadcast receiver to minimize the risk of exploitation.

Fix

Related Identifiers

CVE-2025-20958

Affected Products

Unifiedwfc

References · 6

• https://nvd.nist.gov/vuln/detail/CVE-2025-20958 · Security Note
• https://security.samsungmobile.com/securityUpdate.smsb?year=2025&month=05 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2025-20958 · Vendor Advisory
• https://t.me/cvenotify/121167 · Telegram Post
• https://twitter.com/VulmonFeeds/status/1920149938257657957 · Twitter Post
• https://twitter.com/CVEnew/status/1920038112312402143 · Twitter Post