Introduction
A critical authorization bypass in Qualcomm's QCA7005 Powerline Communication firmware lets an unauthenticated attacker on an adjacent network trigger a buffer overflow. The compromise may extend past the PLC chip to connected automotive and industrial systems. The vulnerability carries a CVSS score of 9.6 and a scope change designation, so it matters most to organizations deploying Snapdragon Auto platform components in EV charging infrastructure and connected vehicle environments.
The QCA7005 is a Qualcomm chipset that provides 10 MBps Powerline Communication, used mainly within the Snapdragon Auto platform for automotive connectivity and EV charging. Powerline Communication sends data over existing electrical wiring, and EV charging stations rely on it for vehicle-to-grid communication. Because the chipset is deployed in safety-critical automotive contexts, flaws in its firmware are especially consequential.
Technical Information
The root cause of CVE-2026-25293 is an incorrect authorization check in the QCA7005 PLC firmware. When that check is bypassed, the result is a buffer overflow. The vulnerability is classified under CWE-863 (Incorrect Authorization): the firmware does not properly verify that a requesting entity has the necessary permissions before it processes input that eventually overflows a buffer.
The CVSS 3.1 vector string is AV:A/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H. The individual metrics break down as follows:
| Metric | Value | Implication |
|---|---|---|
| Attack Vector | Adjacent | Attacker must have access to the adjacent network (e.g., shared powerline segment) |
| Attack Complexity | Low | No specialized conditions or extenuating circumstances required |
| Privileges Required | None | No prior authentication needed |
| User Interaction | None | Exploit triggers without any action from a legitimate user |
| Scope | Changed | Compromise can impact resources beyond the vulnerable component |
| Confidentiality | High | Complete loss of confidentiality possible |
| Integrity | High | Complete loss of integrity possible |
| Availability | High | Complete loss of availability possible |
The Scope: Changed designation is the most consequential part of this rating. A successful exploit against the PLC firmware can affect resources beyond the vulnerable component itself. On the Snapdragon Auto platform, this could mean lateral movement from the compromised PLC chip into connected vehicle systems, telematics units, or EV charging infrastructure controllers.
Attack Flow
Based on the available technical details, exploitation would proceed along these lines:
- The attacker gains access to the adjacent powerline network. In EV charging scenarios, this could mean connecting to the same electrical circuit as the target device, possibly through a public or shared charging station.
- The attacker sends crafted traffic to the QCA7005 chip over the powerline network.
- Because of the incorrect authorization defect, the firmware processes the malicious input without verifying that the sender has appropriate permissions.
- The improperly authorized input triggers a buffer overflow in the PLC firmware.
- The overflow gives the attacker control over the PLC firmware execution context.
- Because of the scope change, the attacker may then pivot from the compromised PLC firmware to other systems connected through the Snapdragon Auto platform.
No authentication, no user interaction, and low attack complexity together make this vulnerability particularly accessible to any attacker who can get a position on the adjacent network.
Affected Systems and Versions
The vulnerability affects the Qualcomm QCA7005 Powerline Communication chipset, part of the Snapdragon Auto platform. The QCA7005 operates at 10 MBps and is used in automotive connectivity and EV charging applications.
Qualcomm's May 2026 Security Bulletin identifies the affected component as PLC firmware (PLC FW). The available documentation does not list specific firmware version numbers. Organizations should consult the bulletin directly and contact their device manufacturer for the exact versions relevant to their deployments.
Vendor Security History
Qualcomm runs a structured product security program that publishes monthly security bulletins to help customers incorporate security updates into launched or upcoming devices. The May 2026 Security Bulletin follows the company's coordinated disclosure model: it sorts vulnerabilities by technology area and severity and acknowledges external researchers. Qualcomm works with the security research community on an ongoing basis, including organizations like the Trend Micro Zero Day Initiative.
