CVE-2025-27071 is a High severity (CVSS 7.3) memory corruption flaw in Powerline Communication firmware for Qualcomm FastConnect 6800, 6900, 7800 and QCA6391 chips. Qualcomm covers it in its August 2025 bulletin, so apply the fix your device maker provides, and start by listing which devices use these chips.
What's affected
The record lists these Qualcomm products and their firmware: FastConnect 6800, FastConnect 6900, FastConnect 7800 and QCA6391. The weakness is in how the Powerline Communication firmware processes specific files.
The record does not give fixed firmware versions, and the bulletin page did not render in my fetch, so use the August 2025 Qualcomm security bulletin directly. In practice, Qualcomm supplies fixes to device makers, who then ship updates to you. Your fix usually arrives as a phone, router, laptop or module update from the maker, not from Qualcomm.
So your first question is which of your devices contain these chips, and who supports them.
How to check if you're exposed
There is no single command, because the chips sit inside other products. Work from your asset records.
On a Linux machine with a wireless module, you can see which hardware it has:
lspci -nn | grep -i -E "network|wireless"
lsusb 2>/dev/null
Compare the model names against the list in the record. For phones, laptops, routers and embedded devices, check the manufacturer's security bulletin or support page, which usually states whether a given model is affected and which update fixes it.
If you manage devices with an MDM or an asset tool, search by chipset or by model. Record the firmware or build number so you can confirm the update afterwards.
What to do now
- Make a list of devices and modules in your fleet that use FastConnect 6800, 6900, 7800 or QCA6391.
- Read Qualcomm's August 2025 security bulletin for the affected components.
- Check each device maker's support page for an update that includes the fix.
- Apply the updates through your normal firmware or patch process, starting with devices most exposed to untrusted networks.
- Where no update exists, note the device in your risk register and consider whether the Powerline feature can be turned off.
- Record firmware versions after updating so you can show the result.
Why it matters
The record lists CWE-120: a classic buffer copy without checking the size of the input. When firmware copies data into a fixed size area without checking the length, the extra bytes overwrite neighbouring memory. That can crash the device or, in worse cases, change its behaviour.
The CVSS vector rates the attack as network based with low complexity, no privileges and no user interaction, and scores the impact as low in each area. The bulletin text in the record is brief: memory corruption while processing specific files. The record's KEV flag is false, so it is not in the CISA Known Exploited Vulnerabilities catalog.
Firmware issues are slow to fix across a fleet because each maker ships updates on its own schedule. An accurate hardware inventory is what turns a bulletin into an action list.
Quick check
Do I get the fix from Qualcomm?
Usually not directly. Qualcomm provides fixes to device manufacturers, who release updates. Check your device maker's support page.
Is this exploited in the wild?
The record's KEV flag is false and the record states no exploitation. Treat it as a patching task with normal priority and higher priority for exposed devices.
Sources
Last reviewed: 19 October 2026.
