Loading vulnerability…
CVE-2025-31710 is a command injection vulnerability in the engineermode service caused by improper input validation. The flaw allows attacker-controlled input to be interpreted as operating system command content rather than inert data. Available reporting associates the issue with the EngineerMode functionality and indicates exploitation can occur through a local interface, enabling arbitrary command execution within the context of the vulnerable component. The vulnerability is described as leading to local privilege escalation without requiring additional execution privileges beforehand.
Mallory correlates every CVE against your assets, your vendors, and active adversary campaigns. Know which vulnerabilities matter for you, not just which ones are loud.
What it means. What to do now. Patch path, mitigations, and the assume-compromise checklist.
What an attacker gets, and what they’ve been doing with it.
If you can’t patch tonight, do this now.
Patch, then assume compromise.
1 valid exploit after Mallory filtered fakes, detection scripts, and README-only repos.
This repository provides a comprehensive exploit toolkit for Unisoc-based Android devices, specifically targeting the EngineerMode app and the cmd_skt abstract socket (CVE-2025-31710, inspired by CVE-2022-47339). The exploit chain involves enabling and abusing trusted client status to connect to a root-privileged socket, ultimately granting a root shell on affected devices. The toolkit includes multiple shell scripts for different privilege escalation scenarios (ADB, shizuku, system shell), helper scripts for environment setup, and a post-exploit persistence mechanism called GhostRoot. GhostRoot establishes a stealthy, file-based root command channel using files on the SD card, allowing any untrusted app to execute commands as root by writing to a specific file, with output returned via another file. The exploit is operational and weaponized for local privilege escalation, but requires some user interaction and specific device configuration. The codebase is primarily shell scripts with a C implementation of the GhostRoot client, and includes detailed documentation and usage instructions. Numerous fingerprintable file paths are used for command/control and environment setup, and the attack vector is local (requires shell access).
Products and vendors Mallory has correlated with this vulnerability. Open in Mallory to drill down to specific CPE configurations and version ranges.
Vendor-confirmed product mapping. Mallory continuously reconciles this list against your asset inventory.
5 sources tracked across advisories and community write-ups. News coverage will land here when it surfaces.
No news coverage yet. Advisories and community discussion only.
Query your assets running an affected version, and investigate the blast radius.
Every observed campaign linking this CVE to a named adversary.
Malware families riding this exploit, with evidence and IOCs.
YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.
Cross-references every affected SKU, including bundled OEM variants.
Community discussion across Reddit, Mastodon, and other social sources.