CVE-2025-7020
BYD DiLink OS Incorrect encryption Implementation of system log dumps
- State
- Published
- Severity
- 5.1 Medium
- Published
- Aug 9, 2025
- Updated
- Aug 11, 2025
- Reserved
- Jul 2, 2025
Description
An incorrect encryption implementation vulnerability exists in the system log dump feature of BYD's DiLink 3.0 OS (e.g. in the model ATTO3). An attacker with physical access to the vehicle can bypass the encryption of log dumps on the In-Vehicle Infotainment (IVI) unit's storage. This allows the attacker to access and read system logs containing sensitive data, including personally identifiable information (PII) and location data.
This vulnerability was introduced in a patch intended to fix CVE-2024-54728.
Scores
| CVSS | Score | Vector | Source |
|---|---|---|---|
| 4.0 | 5.1 Medium | CVSS:4.0/AV:P/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:L/SI:N/SA:N/AU:Y/V:D/RE:H | ASRG |
Weaknesses
- CWE-656 Incorrect Encryption Implementation
Affected Products
| Product | Versions |
|---|---|
DiLink OSBYD |
|
References
- https://asrg.io/security-advisories/cve-2025-7020/third-party-advisory
Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.