CVE-2025-37138

An authenticated command injection vulnerability exists in the command line interface binary of AOS-10 GW and AOS-8 Controllers/Mobility Conductor operating system. Exploitation of this vulnerability requires physical access to the hardware controllers. A successful attack could allow an...

CVE-2025-59191 Windows Connected Devices Platform Service Elevation of Privilege Vulnerability

...

CVE-2025-59191 Windows Connected Devices Platform Service Elevation of Privilege Vulnerability

...

CVE-2025-59191

CVE-2025-59191 is a Windows security vulnerability in the Connected Devices Platform Service (Cdpsvc). It is described as a heap-based buffer overflow that, when exploited by an authenticated local attacker, enables elevation of privileges. The CVE is documented with a high impact (local, privile...

CVE-2025-58727

CVE-2025-58727 describes a race-condition in the Windows Connected Devices Platform Service (Cdpsvc) that allows an authenticated, local attacker to elevate privileges. The issue originates from concurrent execution using a shared resource without proper synchronization. Documents identify the af...

CVE-2025-58727 Windows Connected Devices Platform Service Elevation of Privilege Vulnerability

...

CVE-2025-58727 Windows Connected Devices Platform Service Elevation of Privilege Vulnerability

...

CVE-2025-55326 Windows Connected Devices Platform Service (Cdpsvc) Remote Code Execution Vulnerability

...

CVE-2025-55326

CVE-2025-55326 is a Windows Cdpsvc (Connected Devices Platform Service) use-after-free vulnerability enabling remote code execution over a network. The provided connected documents confirm the issue, its network vector and a high risk (CVSS 3.1: 7.5, network attack, no privileges). Remediation in...

CVE-2025-55326 Windows Connected Devices Platform Service (Cdpsvc) Remote Code Execution Vulnerability

...

CVE-2025-58719 Windows Connected Devices Platform Service Elevation of Privilege Vulnerability

...

CVE-2025-58719

CVE-2025-58719 affects the Connected Devices Platform Service (Cdpsvc) in Windows. The issue is a use-after-free vulnerability that could allow an authorized local attacker to achieve privilege elevation. The connected documents confirm the vulnerability and its local impact, but do not provide e...

CVE-2025-58719 Windows Connected Devices Platform Service Elevation of Privilege Vulnerability

...

CVE-2025-0033

CVE-2025-0033 affects AMD SEV-SNP and describes a race condition in the Reverse Map Table (RMP) initialization that could allow a privileged hypervisor to modify RMP contents, potentially compromising SEV-SNP guest memory integrity. Affected hardware/stack: AMD EPYC processors with SEV-SNP. The r...

CVE-2025-0033

Improper access control within AMD SEV-SNP could allow an admin privileged attacker to write to the RMP during SNP initialization, potentially resulting in a loss of SEV-SNP guest memory integrity...

Windows Connected Devices Platform Service (Cdpsvc) Remote Code Execution Vulnerability

Use after free in Connected Devices Platform Service Cdpsvc allows an unauthorized attacker to execute code over a network...

Windows Connected Devices Platform Service Elevation of Privilege Vulnerability

Use after free in Connected Devices Platform Service Cdpsvc allows an authorized attacker to elevate privileges locally...

Windows Connected Devices Platform Service Elevation of Privilege Vulnerability

Heap-based buffer overflow in Connected Devices Platform Service Cdpsvc allows an authorized attacker to elevate privileges locally...

Windows Connected Devices Platform Service Elevation of Privilege Vulnerability

Concurrent execution using shared resource with improper synchronization 'race condition' in Windows Connected Devices Platform Service allows an authorized attacker to elevate privileges locally...

New Pixnapping Android Flaw Lets Rogue Apps Steal 2FA Codes Without Permissions

Android devices from Google and Samsung have been found vulnerable to a side-channel attack that could be exploited to covertly steal two-factor authentication 2FA codes, Google Maps timelines, and other sensitive data without the users' knowledge pixel-by-pixel. The attack has been codenamed...