The specific flaw exists within the configuration of the application system-on-chip (SoC). The issue results from the lack of a properly configured hardware root of trust. An attacker can leverage this vulnerability to escalate privileges and execute arbitrary code in the context of the boot process. Was ZDI-CAN-25948.
Analysis
Analysis and contextual insights are available on OpenCVE Cloud.
Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).
| Vendor | Product | Default status | Versions | ||||||
|---|---|---|---|---|---|---|---|---|---|
| CarlinKit | CPC200-CCPA | unknown |
|
Configuration 1 [-]
| AND |
|
No data.
No data available yet.
No vendor fix or workaround currently provided.
Additional remediation guidance may be available on OpenCVE Cloud.
Tracking
Sign in to view the affected projects.
| Source | ID | Title |
|---|---|---|
 EUVD |
EUVD-2025-12181 | CarlinKit CPC200-CCPA Missing Root of Trust Local Privilege Escalation Vulnerability. This vulnerability allows local attackers to escalate privileges on affected installations of CarlinKit CPC200-CCPA devices. An attacker must first obtain the ability to execute low-privileged code on the target system in order to exploit this vulnerability. The specific flaw exists within the configuration of the application system-on-chip (SoC). The issue results from the lack of a properly configured hardware root of trust. An attacker can leverage this vulnerability to escalate privileges and execute arbitrary code in the context of the boot process. Was ZDI-CAN-25948. |
| Link | Providers |
|---|---|
| https://www.zerodayinitiative.com/advisories/ZDI-25-176/ |
|
Fri, 11 Jul 2025 14:15:00 +0000
| Type | Values Removed | Values Added |
|---|---|---|
| First Time appeared |
Carlinkit autokit
|
|
| CPEs | cpe:2.3:a:carlinkit:autokit:2024.01.19.1541:*:*:*:*:*:*:* | |
| Vendors & Products |
Carlinkit cpc200-ccpa Firmware
|
Carlinkit autokit
|
Fri, 11 Jul 2025 13:45:00 +0000
| Type | Values Removed | Values Added |
|---|---|---|
| First Time appeared |
Carlinkit
Carlinkit cpc200-ccpa Carlinkit cpc200-ccpa Firmware |
|
| CPEs | cpe:2.3:h:carlinkit:cpc200-ccpa:-:*:*:*:*:*:*:* cpe:2.3:o:carlinkit:cpc200-ccpa_firmware:2024.01.19.1541:*:*:*:*:*:*:* |
|
| Vendors & Products |
Carlinkit
Carlinkit cpc200-ccpa Carlinkit cpc200-ccpa Firmware |
Wed, 23 Apr 2025 19:15:00 +0000
| Type | Values Removed | Values Added |
|---|---|---|
| Metrics |
ssvc
|
Wed, 23 Apr 2025 17:00:00 +0000
| Type | Values Removed | Values Added |
|---|---|---|
| Description | CarlinKit CPC200-CCPA Missing Root of Trust Local Privilege Escalation Vulnerability. This vulnerability allows local attackers to escalate privileges on affected installations of CarlinKit CPC200-CCPA devices. An attacker must first obtain the ability to execute low-privileged code on the target system in order to exploit this vulnerability. The specific flaw exists within the configuration of the application system-on-chip (SoC). The issue results from the lack of a properly configured hardware root of trust. An attacker can leverage this vulnerability to escalate privileges and execute arbitrary code in the context of the boot process. Was ZDI-CAN-25948. | |
| Title | CarlinKit CPC200-CCPA Missing Root of Trust Local Privilege Escalation Vulnerability | |
| Weaknesses | CWE-1326 | |
| References |
| |
| Metrics |
cvssV3_0
|
MITRE
Status: PUBLISHED
Assigner: zdi
Published:
Updated: 2025-04-23T18:20:33.799Z
Reserved: 2025-03-24T19:42:35.529Z
Link: CVE-2025-2762
Vulnrichment
Updated: 2025-04-23T18:20:27.943Z
NVD
Status : Analyzed
Published: 2025-04-23T17:16:54.160
Modified: 2025-07-11T14:07:00.030
Link: CVE-2025-2762
Redhat
No data.
OpenCVE Enrichment
No data.