PT-2025-32437 · Byd · Byd Dilink 3.0 Os

Published 2025-08-09 · Updated 2025-08-09 · CVE-2025-7020

Positive Technologies (AI Summary)

CVSS v4.0

5.1

Medium

Base vector

AV:P/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:L/SI:N/SA:N/AU:Y/V:D/RE:H

Name of the Vulnerable Software and Affected Versions: BYD DiLink 3.0 OS (affected versions not specified)

Description: An incorrect encryption implementation exists in the system log dump feature. An attacker with physical access to the vehicle can bypass the encryption of log dumps on the In-Vehicle Infotainment (IVI) unit's storage, allowing access to system logs containing sensitive data, including personally identifiable information (PII) and location data. This issue was introduced in a patch intended to fix a previous issue.

Recommendations: At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Weakness Enumeration

CWE-656

Related Identifiers

CVE-2025-7020

Affected Products

Byd Dilink 3.0 Os

References · 5

• https://nvd.nist.gov/vuln/detail/CVE-2025-7020 · Security Note
• https://t.me/CVEtracker/29582 · Telegram Post
• https://asrg.io/security-advisories/cve-2025-7020 · Note
• https://t.me/cveNotify/131552 · Telegram Post
• https://twitter.com/CVEnew/status/1954176278887895140 · Twitter Post