CVE-2025-7020 - CVE House
Back to Database
Status published Medium CVE-2025-7020

BYD DiLink OS Incorrect encryption Implementation of system log dumps

Vulnerability Description

An incorrect encryption implementation vulnerability exists in the system log dump feature of BYD's DiLink 3.0 OS (e.g. in the model ATTO3). An attacker with physical access to the vehicle can bypass the encryption of log dumps on the In-Vehicle Infotainment (IVI) unit's storage. This allows the attacker to access and read system logs containing sensitive data, including personally identifiable information (PII) and location data. This vulnerability was introduced in a patch intended to fix CVE-2024-54728.

Impact Analysis

Refer to official advisory for detailed impact metrics.

Remediation

Ensure systems are updated to the latest vendor-supplied patch levels.

THREAT MONITOR

Am I Vulnerable?

Launch our assessment wizard to check if your infrastructure is exposed to • CVE-2025-7020

Credits & Attribution

The following person or organization is credited with identifying this vulnerability, as recorded in the NVD database:

  • Lior Zur Lotan (PlaxidityX)

References

Affected Vendor

Affected Software

DiLink OS
Vulnerable Versions:
13.1.32.2307211.1

Timeline

Official Publish: August 9th, 2025
Last Modified: August 11th, 2025
Added to House: July 22nd, 2026

CVSS Vectors

Weaknesses (CWE)

CWE-656

MITRE ATT&CK TTPs

No associated TTPs found for this vulnerability.