Universal Boot Loader (U-Boot) (Update A)
Successful exploitation of this vulnerability could result in arbitrary code execution.
describes (1)
Related CVEs.
| ID | severity | exploitable | ||
|---|---|---|---|---|
| CVE-2025-24857US | — | — | ||
Improper access control for volatile memory containing boot code in Universal Boot Loader (U-Boot) before 2017.11 and Qualcomm chips IPQ4019, IPQ5018, IPQ5322, IPQ6018, IPQ8064, IP… | ||||
references
External citations — patches, advisories, analysis.
- ICS Advisory ICSA-25-343-01 JSONself
- ICSA Advisory ICSA-25-343-01 - Web Versionself
- Recommended Practicesexternal
- Recommended Practicesexternal
- Recommended Practicesexternal
- Recommended Practicesexternal
- Recommended Practicesexternal
- Recommended Practicesexternal
remediations (10)
- MitigationU-Boot U-boot: <2017.11 installed on Johnson Controls Airwall AW-75 vers:all/*
Johnson Controls recommend users to consider the following defensive measure: (1) Deploy Airwall in a physically secure location so an attacker can't plug in USB devices. (2) Restrict physical access to USB A ports (not the micro-USB console port which is not affected) by sealing them with epoxy or a similar material. (3) For Airwall 75 gateways running U-Boot version 2017.03 and before (version number is displayed on the console port as the Airwall gateway boots), install hotfix hf-3303 to update U-Boot. Hotfix can be downloaded from https://webhelp.tempered.io/content/topics/downloads_hotfixes.html#downloads_hotfixes__section_vw4_25x_13c
https://webhelp.tempered.io/content/topics/downloads_hotfixes.html#downloads_hotfixes__section_vw4_25x_13c - MitigationU-Boot U-boot: <2017.11 installed on Qualcomm Chipset IPQ4019
Qualcomm recommends users with the affected chips to contact support referencing CVE-2025-24857, QPSIIR-1969 or CR4082905.
https://www.qualcomm.com/support/contact - MitigationU-Boot U-boot: <2017.11 installed on Qualcomm Chipset IPQ5018
Qualcomm recommends users with the affected chips to contact support referencing CVE-2025-24857, QPSIIR-1969 or CR4082905.
https://www.qualcomm.com/support/contact - MitigationU-Boot U-boot: <2017.11 installed on Qualcomm Chipset IPQ5322
Qualcomm recommends users with the affected chips to contact support referencing CVE-2025-24857, QPSIIR-1969 or CR4082905.
https://www.qualcomm.com/support/contact - MitigationU-Boot U-boot: <2017.11 installed on Qualcomm Chipset IPQ6018
Qualcomm recommends users with the affected chips to contact support referencing CVE-2025-24857, QPSIIR-1969 or CR4082905.
https://www.qualcomm.com/support/contact - MitigationU-Boot U-boot: <2017.11 installed on Qualcomm Chipset IPQ8064
Qualcomm recommends users with the affected chips to contact support referencing CVE-2025-24857, QPSIIR-1969 or CR4082905.
https://www.qualcomm.com/support/contact - MitigationU-Boot U-boot: <2017.11 installed on Qualcomm Chipset IPQ8074
Qualcomm recommends users with the affected chips to contact support referencing CVE-2025-24857, QPSIIR-1969 or CR4082905.
https://www.qualcomm.com/support/contact - MitigationU-Boot U-boot: <2017.11 installed on Qualcomm Chipset IPQ9574
Qualcomm recommends users with the affected chips to contact support referencing CVE-2025-24857, QPSIIR-1969 or CR4082905.
https://www.qualcomm.com/support/contact - FixedU-Boot
Konsulko, the third-party maintainer of U-boot, recommends users upgrade to version v2025.4 or later and ensure the physical security of the device.
https://ftp.denx.de/pub/u-boot/ - FixedU-Boot U-boot: <2017.11 installed on Johnson Controls Airwall AW-75 vers:all/*
Konsulko, the third-party maintainer of U-boot, recommends users upgrade to version v2025.4 or later and ensure the physical security of the device.
https://ftp.denx.de/pub/u-boot/
Advisories like this name the exposed products attackers go after on your perimeter. See what is exposed on your perimeter with a free passive scan.
Free scan