« Volver al listado

CVE-2025-1121

Estado: AnalizadaMedia (6.8)—

Privilege escalation in Installer and Recovery image handling in Google ChromeOS version 15786.48.2 on device allows an attacker with physical access to gain root code execution and potentially unenroll enterprise-managed devices via a specially crafted recovery image.

CVSS

Probabilidad de explotación (EPSS)

EPSS (Exploit Prediction Scoring System, de FIRST) estima la probabilidad de que una vulnerabilidad sea explotada en 30 días. Complementa a CVSS (impacto) y a CISA KEV (explotación confirmada).

Tecnologías afectadas (1)

Google — Chrome OS

CWE

Referencias

JSON original (NVD)

Mostrar
{
  "id": "CVE-2025-1121",
  "cveTags": [],
  "metrics": {
    "ssvcV203": [
      {
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "ssvcData": {
          "id": "CVE-2025-1121",
          "role": "CISA Coordinator",
          "options": [
            {
              "exploitation": "poc"
            },
            {
              "automatable": "no"
            },
            {
              "technicalImpact": "total"
            }
          ],
          "version": "2.0.3",
          "timestamp": "2025-03-07T19:38:04.878602Z"
        }
      }
    ],
    "cvssMetricV31": [
      {
        "type": "Secondary",
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "cvssData": {
          "scope": "UNCHANGED",
          "version": "3.1",
          "baseScore": 6.8,
          "attackVector": "PHYSICAL",
          "baseSeverity": "MEDIUM",
          "vectorString": "CVSS:3.1/AV:P/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
          "integrityImpact": "HIGH",
          "userInteraction": "NONE",
          "attackComplexity": "LOW",
          "availabilityImpact": "HIGH",
          "privilegesRequired": "NONE",
          "confidentialityImpact": "HIGH"
        },
        "impactScore": 5.9,
        "exploitabilityScore": 0.9
      }
    ]
  },
  "affected": [
    {
      "source": "7f6e188d-c52a-4a19-8674-3c3fa7d1fc7f",
      "affectedData": [
        {
          "vendor": "Google",
          "product": "ChromeOS",
          "versions": [
            {
              "status": "affected",
              "version": "15786.48.2",
              "lessThan": "15786.48.2",
              "versionType": "custom"
            }
          ]
        }
      ]
    }
  ],
  "published": "2025-03-07T00:15:34.360",
  "references": [
    {
      "url": "https://issues.chromium.org/issues/b/336153054",
      "tags": [
        "Broken Link",
        "Issue Tracking",
        "Vendor Advisory"
      ],
      "source": "7f6e188d-c52a-4a19-8674-3c3fa7d1fc7f"
    },
    {
      "url": "https://issuetracker.google.com/issues/336153054",
      "tags": [
        "Issue Tracking",
        "Vendor Advisory"
      ],
      "source": "7f6e188d-c52a-4a19-8674-3c3fa7d1fc7f"
    },
    {
      "url": "https://issuetracker.google.com/issues/336153054",
      "tags": [
        "Issue Tracking",
        "Vendor Advisory"
      ],
      "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0"
    }
  ],
  "vulnStatus": "Analyzed",
  "weaknesses": [
    {
      "type": "Secondary",
      "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
      "description": [
        {
          "lang": "en",
          "value": "CWE-269"
        }
      ]
    }
  ],
  "descriptions": [
    {
      "lang": "en",
      "value": "Privilege escalation in Installer and Recovery image handling in Google ChromeOS version 15786.48.2 on device allows an attacker with physical access to gain root code \nexecution and potentially unenroll enterprise-managed devices via a specially crafted recovery image."
    },
    {
      "lang": "es",
      "value": "La escalada de privilegios en la gestión de imágenes de instalación y recuperación en Google ChromeOS 123.0.6312.112 en el dispositivo permite que un atacante con acceso físico obtenga la ejecución del código raíz y potencialmente cancele la inscripción de dispositivos administrados por la empresa a través de una imagen de recuperación especialmente manipulada."
    }
  ],
  "lastModified": "2026-06-17T08:38:25.297",
  "configurations": [
    {
      "nodes": [
        {
          "negate": false,
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:o:google:chrome_os:15786.48.0:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "D681E31E-CF4E-4853-9837-77B14FF419E8"
            }
          ],
          "operator": "OR"
        }
      ]
    }
  ],
  "sourceIdentifier": "7f6e188d-c52a-4a19-8674-3c3fa7d1fc7f"
}