Coverage › CVE-2025-21480
CVE-2025-21480 Mapped Sigma
Qualcomm Multiple Chipsets Incorrect Authorization Vulnerability
- Vendor / product
- Qualcomm — Multiple Chipsets
- Description (CISA)
- Multiple Qualcomm chipsets contain an incorrect authorization vulnerability. This vulnerability allows for memory corruption due to unauthorized command execution in GPU micronode while executing specific sequence of commands.
- Added to KEV
- 2025-06-03
- Due date
- 2025-06-24
- Required action
- Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.
- Known ransomware use
- Unknown
- CWE
- CWE-863
- CISA notes
- Please check with specific vendors (OEMs,) for information on patching status. For more information, please see: https://docs.qualcomm.com/product/publicresources/securitybulletin/june-2025-bulletin.html
https://nvd.nist.gov/vuln/detail/CVE-2025-21480 - Elsewhere
- cve.org · NVD · CISA KEV · JSON
ATT&CK techniques · CTID Mappings Explorer, ATT&CK 16.1, KEV snapshot 2025-07-28
2 mapping objects across 2 techniques. exploitation technique states how the vulnerability is exploited; primary and secondary impact state what exploitation achieves. They are different claims and are labelled as such.
| Technique | Mapping type | CTID comment | Status in v19.2 |
|---|---|---|---|
| T1055 Process Injection | exploitation technique | — ref 1 · ref 2 |
live |
| T1495 Firmware Corruption | primary impact | — ref 1 · ref 2 |
live |
Detection chain · ATT&CK Enterprise v19.2 detection strategies, analytics, log sources
T1055 Process Injection exploitation technique
- DET0508 Behavioral Detection of Process Injection Across Platforms
AN1399 WindowsDetects process injection by correlating memory manipulation API calls (e.g., VirtualAllocEx, WriteProcessMemory), suspicious thread creation (e.g., CreateRemoteThread), and unusual DLL loads within another process's context.Tunable:
AccessMaskTimeWindowInjectedProcessListAN1400 LinuxDetects ptrace- or memfd-based process injection through audit logs capturing system calls (e.g., ptrace, mmap) targeting running processes along with suspicious file descriptors or memory writes.Tunable:TargetPIDThresholdTimeWindowAN1401 macOSDetects memory-based injection by monitoringtask_for_pid,mach_vm_write, and dylib injection patterns throughDYLD_INSERT_LIBRARIESor manual memory mapping.macos:unifiedlogsubsystem=com.apple.security, library=libsystem_kernel.dylib→ DC0035 Process Accessmacos:endpointsecurityES_EVENT_TYPE_NOTIFY_EXEC, ES_EVENT_TYPE_NOTIFY_MMAP→ DC0034 Process MetadataTunable:TargetProcessSignatureMachSyscallContext
Sigma rules tagged attack.t1055 (37)
Author: Perez Diego (@darkquassar), oscd.community
· 2019-10-27 (modified 2025-12-08) · logsource: product=windows category=create_remote_thread · 02d1d718-dd13-41af-989d-ea85c7fab93f
Detects uncommon processes creating remote threads.
Author: Florian Roth (Nextron Systems)
· 2021-07-30 (modified 2026-06-18) · logsource: product=windows category=pipe_created · 0e7163d4-9e19-4fa7-9be6-000c61aad77a
Detects the creation of a named pipe matching a pattern used by CobaltStrike Malleable C2 profiles
Author: frack113
· 2022-12-31 · logsource: product=windows category=image_load · 0fa66f66-e3f6-4a9c-93f8-4f2610b00171
Detect usage of the "coregen.exe" (Microsoft CoreCLR Native Image Generator) binary to sideload arbitrary DLLs.
Author: David Ledbetter (shellcode), Florian Roth (Nextron Systems)
· 2018-11-17 (modified 2024-01-25) · logsource: product=windows category=ps_script · 16b37b70-6fcf-4814-a092-c36bd3aafcbd
Detects Base64 encoded Shellcode
Author: David Burkett, @signalblur
· 2019-12-28 (modified 2022-06-27) · logsource: product=windows category=process_creation · 16c37b52-b141-42a5-a3ea-bbe098444397
It is extremely abnormal for svchost.exe to spawn without any CLI arguments and is normally observed when a malicious process spawns the process and injects code into the process memory space.
Author: Joseliyo Sanchez, @Joseliyo_Jstnk
· 2024-12-19 · logsource: product=windows category=process_creation · 19b3806e-46f2-4b4c-9337-e3d8653245ea
Detects the execution of more.com and vbc.exe in the process tree.
This behavior was observed by a set of samples related to Lummac Stealer.
The Lummac payload is injected into the vbc.exe process.
Author: Florian Roth (Nextron Systems)
· 2021-03-05 (modified 2022-10-09) · logsource: product=windows category=process_creation · 1cc50f3f-1fc8-4acf-b2e9-6f172e1fdebd
Detects suspicious process related to rundll32 based on command line that invokes inline VBScript as seen being used by UNC2452
Author: Bhabesh Raj
· 2022-03-11 (modified 2024-07-02) · logsource: product=windows category=process_access · 250ae82f-736e-4844-a68b-0b5e8cc887da
Detects potential shellcode injection as seen used by tools such as Metasploit's migrate and Empire's psinject.
Author: Florian Roth (Nextron Systems)
· 2021-09-07 (modified 2022-10-09) · logsource: product=windows category=image_load · 33a2d1dd-f3b0-40bd-8baf-7974468927cc
Detects an image load pattern as seen when a tool named PRIVATELOG is used and rarely observed under legitimate circumstances
Author: Florian Roth (Nextron Systems)
· 2022-10-14 (modified 2024-08-29) · logsource: product=windows category=process_creation · 396f6630-f3ac-44e3-bfc8-1b161bc00c4e
Detects suspicious Windows Error Reporting manager (wermgr.exe) child process
Author: Max Altgelt (Nextron Systems)
· 2022-08-23 (modified 2025-10-08) · logsource: product=windows category=process_creation · 3c1b5fb0-c72f-45ba-abd1-4d4c353144ab
Detects process creation events that use the Sysnative folder (common for CobaltStrike spawns)
Author: elhoim
· 2022-04-28 (modified 2022-06-02) · logsource: product=windows category=file_event · 409f8a98-4496-4aaa-818a-c931c0a8b832
This rule detects suspicious files created by Microsoft Sync Center (mobsync)
Author: omkar72, oscd.community
· 2020-10-14 (modified 2023-02-23) · logsource: product=windows category=image_load · 4508a70e-97ef-4300-b62b-ff27992990ea
Detects .NET CLR DLLs being loaded by scripting applications such as wscript or cscript. This could be an indication of potential suspicious execution.
Author: Florian Roth (Nextron Systems)
· 2023-10-11 · logsource: product=windows category=pipe_created · 4d0083b3-580b-40da-9bba-626c19fe4033
Detects the pattern of a pipe name as used by the hack tool CoercedPotato
Author: Florian Roth (Nextron Systems)
· 2021-08-23 (modified 2023-12-21) · logsource: product=windows category=pipe_created · 637f689e-b4a5-4a86-be0e-0100a0a33ba2
Detects the pattern of a pipe name as used by the hack tool EfsPotato
All 37 rules on the technique page →
T1495 Firmware Corruption primary impact
- DET0167 Firmware Modification via Flash Tool or Corrupted Firmware Upload
AN0474 WindowsFirmware flash utility invoked with elevated privileges followed by raw access to firmware device path or changes to boot configuration.WinEventLog:Microsoft-Windows-Kernel-Boot
Firmware integrity validation failed or boot configuration tampered→ DC0004 Firmware ModificationTunable:ParentImageCommandLineAN0475 LinuxDirect write access to /dev/mem or /sys/firmware combined with usage of firmware flashing utilities (e.g., flashrom).Tunable:ToolNameAN0476 macOSEFI updates executed via system processes or binaries outside of expected patch windows or using unsigned firmware packages.macos:unifiedlogcom.apple.firmwareupdater activity or update-firmware binary invoked→ DC0032 Process CreationTunable:UpdateTimeWindowAN0477 Network DevicesFirmware image uploaded via TFTP/SCP or web interface followed by reboot or unexpected loss of connectivity.networkdevice:firmwareFirmware update initiated or bootloader tampering detected→ DC0004 Firmware ModificationTunable:UploadSizeThresholdRebootWindow
Sigma rules tagged attack.t1495 (1)
Author: Austin Clark
· 2019-08-15 (modified 2023-01-04) · logsource: product=cisco service=aaa · d94a35f0-7a29-45f6-90a0-80df6159967c
Detect a system being shutdown or put into different boot mode