CVE-2025-65885

Published: Dec 26, 2025Modified: Jun 17, 2026

5.1

Vector

CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N

Exploitability: 2.5 / Impact: 2.5

Source: 134c704f-9b21-4f2e-91b3-4a467353bcc0 (Secondary)

Description

An issue was discovered in the Delight Custom Firmware (CFW) for Nokia Symbian Belle devices on Nokia 808 (Delight v1.8), Nokia N8 (Delight v6.7), Nokia E7 (Delight v1.3), Nokia C7 (Delight v6.7), Nokia 700 (Delight v1.2), Nokia 701 (Delight v1.1), Nokia 603 (Delight v1.0), Nokia 500 (Delight v1.2), Nokia E6 (Delight v1.0), Nokia Oro (Delight v1.0), and Vertu Constellation T (Delight v1.0) allowing local attackers to inject startup scripts via crafted .txt files in the :\Data directory.

Affected (6)

Products: Symwld: Delight Custom Firmware

Symwld

1 product

Delight Custom Firmware

Configuration A

1 vulnerable · 1 platform

Vulnerable Software	Affected Versions
Symwld Delight Custom Firmware	Version 1.8

Running on/with	Platform Versions
Nokia 808 Pureview	All versions

Configuration B

1 vulnerable · 2 platform

Vulnerable Software	Affected Versions
Symwld Delight Custom Firmware	Version 6.7

Running on/with	Platform Versions
Nokia C7	All versions
Nokia N8	All versions

Configuration C

1 vulnerable · 1 platform

Vulnerable Software	Affected Versions
Symwld Delight Custom Firmware	Version 1.3

Running on/with	Platform Versions
Nokia E7	All versions

Configuration D

1 vulnerable · 2 platform

Vulnerable Software	Affected Versions
Symwld Delight Custom Firmware	Version 1.1

Running on/with	Platform Versions
Nokia 701	All versions
Nokia C6 01	All versions

Configuration E

1 vulnerable · 2 platform

Vulnerable Software	Affected Versions
Symwld Delight Custom Firmware	Version 1.2

Running on/with	Platform Versions
Nokia 500	All versions
Nokia 700	All versions

Configuration F

1 vulnerable · 4 platform

Vulnerable Software	Affected Versions
Symwld Delight Custom Firmware	Version 1.0

Running on/with	Platform Versions
Nokia 603	All versions
Nokia E6	All versions
Nokia Oro	All versions
Nokia Vertu Constellation T	All versions

Related CWEs

CWE-77

Improper Neutralization of Special Elements used in a Command ('Command Injection')

The product constructs all or part of a command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended command when it is sent to a downstream component.

References (2)

https://gist.github.com/symbuzzer/3315e88adc2bba0b6cc66d192b49546d

Source: cve@mitre.org

Third Party Advisory

https://www.symwld.com/delight/

Source: cve@mitre.org

Product

Timeline

No history available yet.