Skip to main content

Incomplete Identification of Uploaded File Variables (PHP)

CVE-2025-59402

Medium
5.4/10

Summary

Flock Safety Bravo Edge AI Compute Device BRAVO_00.00_local_20241017 accepts the default Thundercomm TurboX 6490 Firehose loader in EDL/QDL mode. This enables attackers with physical access to flash arbitrary firmware, dump partitions, and bypass bootloader and OS security controls.

  • LOW
  • PHYSICAL
  • HIGH
  • UNCHANGED
  • REQUIRED
  • NONE
  • LOW
  • LOW

CWE-616 - Incomplete Identification of Uploaded File Variables (PHP)

The PHP application uses an old method for processing uploaded files by referencing the four global variables that are set for each file (e.g. $varname, $varname_size, $varname_name, $varname_type). These variables could be overwritten by attackers, causing the application to process unauthorized files.

References

Advisory Timeline

  • Published