ZDI-25-1069: (Pwn2Own) oFono CUSD Stack-based Buffer Overflow Code Execution Vulnerability

Published Dec 10, 2025

Updated

This vulnerability allows local attackers to execute arbitrary code on affected installations of oFono. An attacker must first obtain the ability to execute code on the target modem in order to exploit this vulnerability. The ZDI has assigned a CVSS rating of 7.8. The following CVEs are assigned: CVE-2024-7539.

Affected Software

1 affected component

oFono oFono

Event History

Dec 10, 2025

Advisory Published

via ZDI·06:00 AM

Data Sourced

via ZDI·06:00 AM

Description

Frequently Asked Questions

What is the severity of ZDI-25-1069?

The severity of ZDI-25-1069 is rated 7.8 on the CVSS scale.

How do I fix ZDI-25-1069?

To fix ZDI-25-1069, update your oFono installation to the latest version that addresses this vulnerability.

What type of attacks can exploit ZDI-25-1069?

ZDI-25-1069 can be exploited by local attackers executing arbitrary code on affected installations of oFono.

Is ZDI-25-1069 a remote or local vulnerability?

ZDI-25-1069 is a local vulnerability requiring the attacker to have access to the target modem.

What software is affected by ZDI-25-1069?

The vulnerability ZDI-25-1069 affects installations of the oFono software.