Threat video1:00
CVE-2026-25262 Qualcomm BootROM Flaw: Detection & IOCs
A Qualcomm BootROM flaw lets physical attackers bypass secure boot in Emergency Download Mode. Ships 9 detection rules, 15 IOCs and a free Splunk SPL rule.
Read the full threat intel for CVE-2026-25262 Qualcomm BootROM Flaw: Detection & IOCs →
Chapters
- 0:00The hookQualcomm BootROM flaw unfixable—compromised in minutes.
- 0:05The storyQualcomm BootROM flaw: physical access required.
- 0:12Attack pathDevice forced into Emergency Download Mode.
- 0:30AttributionNo threat actor is attributed.
- 0:34Indicators of compromise3 indicators to hunt: 2 URLs and 1 registry key.
- 0:40MITRE ATT&CK techniques5 ATT&CK techniques, from initial access to impact.
- 0:44Remediation4 steps now: Maintain strict physical control of devices that use affected Qualcomm.
- 0:51Detection rules9 detection rules, in SPL, KQL and Sigma.
Transcript
0:00Qualcomm BootROM flaw unfixable—compromised in minutes.
0:05Qualcomm BootROM flaw: physical access required.
0:09But existing devices cannot be patched.
0:12Device forced into Emergency Download Mode.
0:15Sahara uploads crafted programmer with write-what-where.
0:18BootROM verification fails; arbitrary write triggered.
0:22Secure boot bypassed; maximum privilege code runs.
0:26Persistent firmware implant installed.
0:31No threat actor is attributed. Confidence: low.
0:353 indicators to hunt: 2 URLs and 1 registry key.
0:405 ATT&CK techniques, from initial access to impact.
0:444 steps now: Maintain strict physical control of devices that use affected Qualcomm.
0:519 detection rules, in SPL, KQL and Sigma.
0:56Threadlinqs. The unified security engineering platform.