CVE-2025-59601: Information Disclosure in Qualcomm Wireless & Audio Components Factory Reset

Technical summary

This vulnerability (CWE-1230: Exposure of Sensitive Information Through Metadata) affects factory reset functionality in Qualcomm's FastConnect, QCA, Snapdragon AR1, WCD, and WSA components. The powerline interface—used for device management and configuration—fails to properly sanitize or remove sensitive data during a factory default reset. An attacker positioned on the adjacent network segment can intercept or access residual configuration information that persists after the reset completes. The CVSS 3.1 vector (AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N) reflects that the attack requires adjacent network access but is otherwise straightforward to execute, with high confidentiality impact and no integrity or availability impact.

Business impact

Organizations deploying Qualcomm wireless chipsets—particularly in enterprise WiFi infrastructure, audio systems, and AR/VR platforms—face a risk of configuration data leakage during device lifecycle operations. If devices are repurposed or decommissioned, sensitive settings (authentication credentials, SSID histories, network topology details) may be recoverable by network-adjacent attackers. This could compromise subsequent deployments sharing the same network segment, breach privacy expectations around data sanitization, and create compliance friction in regulated environments where secure device wiping is mandated.

Affected systems

The vulnerability impacts Qualcomm FastConnect 7800, QCA7005, Snapdragon AR1 Gen 1, WCD9380, WCD9385, WSA8830, WSA8832, and WSA8835 components and their associated firmware. These are commonly integrated into enterprise WiFi access points, wireless speakers, AR/VR headsets, smartphones, and audio processing platforms. Organizations should inventory deployments of these specific chipsets to determine exposure scope. Verify exact platform configurations in vendor documentation, as these components appear in diverse device types across multiple vendors.

Exploitability

Exploitation requires an attacker to be on the same network segment (adjacent network access) and to trigger or observe a factory reset operation. No special privileges, user interaction, or complex technical steps are needed once the attacker is positioned. However, the attack window is bounded: it must occur during or immediately after a factory reset. This limits spontaneous exploitation but makes the risk material during planned device decommissioning, refresh cycles, or after-sales device preparation. The barrier to entry is low for network-adjacent attackers in shared infrastructure environments.

Remediation

Contact Qualcomm and your device vendors for firmware patches addressing this issue. Patches should ensure that all sensitive configuration data is cryptographically wiped or securely removed during factory reset operations. Until patches are available, implement compensating controls: restrict network access to management interfaces, use network segmentation to limit adjacency to devices undergoing reset, employ out-of-band management channels where possible, and document device reset procedures to ensure they are performed in controlled, physically secured environments. Verify patch applicability against your specific chipset and firmware versions before deployment.

Patch guidance

Qualified patches from Qualcomm and device OEMs must be verified against the specific product and firmware version in your environment. Check the vendor advisories for affected firmware versions and corresponding patch or update versions. Apply patches in a controlled manner, beginning with non-critical devices to validate compatibility and performance. For devices that cannot be patched immediately, enforce network segmentation and access controls around the powerline management interface. Maintain an inventory of firmware versions in production to track remediation progress.

Detection guidance

Monitor for factory reset events on managed devices, particularly in network segments where sensitive data may be at rest. Log access to powerline management interfaces and correlate reset operations with network traffic patterns that might indicate information exfiltration. Intrusion detection systems should be tuned to flag anomalous access to configuration interfaces during or shortly after reset sequences. Endpoint Detection and Response (EDR) tools on associated systems may flag unusual file or memory access patterns. In air-gapped or controlled environments, periodic verification that sensitive data is properly cleared post-reset can provide assurance that patches or mitigations are effective.

Why prioritize this

Although this vulnerability carries a MEDIUM CVSS score and is not yet on the CISA Known Exploited Vulnerabilities (KEV) list, it warrants timely attention because: (1) it affects core wireless and audio infrastructure widely deployed in enterprise environments, (2) the attack surface includes common lifecycle operations (device reset, decommissioning, refresh) that many organizations perform routinely, and (3) the exposure of configuration data—including potential credentials—can create cascading risks downstream. Organizations should prioritize inventory and patching of affected chipsets over the next 60–90 days, with heightened urgency for devices in high-value network segments or those handling sensitive workloads.

Risk score, explained

The CVSS 3.1 score of 6.5 (MEDIUM) reflects high confidentiality impact (an attacker gains unauthorized access to device configuration) balanced against the requirement for adjacent network access and the absence of integrity or availability impact. The score appropriately captures that this is a serious information disclosure risk but not a critical remote code execution or widespread denial-of-service vector. Organizational risk may be higher or lower depending on deployment context: organizations with poor network segmentation or those frequently decommissioning devices in shared spaces face elevated practical risk; those with strong access controls and air-gapped management networks face lower risk.

Frequently asked questions