CVE-2025-12902 is a firmware vulnerability classified under CWE-665 (Improper Initialization) affecting several Solidigm DC storage products: D5-P5316, D5-P5430, D7-P5520/D7-P5620, and D5-P5336. The issue arises from improper resource management within the device firmware that can be exploited by an attacker who has local or physical access and possesses high-level privileges on the system. This flaw allows unauthorized access to a locked storage device, effectively bypassing security controls designed to protect data confidentiality. Additionally, the vulnerability can be leveraged to cause a denial of service, potentially disrupting availability. The CVSS v3.1 score is 4.4 (medium), reflecting the requirement for local access (AV:L), low attack complexity (AC:L), high privileges (PR:H), no user interaction (UI:N), unchanged scope (S:U), high confidentiality impact (C:H), and no impact on integrity or availability (I:N/A:N). The vulnerability affects all firmware versions prior to specific releases (ACV10360, 6DV10341, 6CV10241, 9CV10490, 5CV10326), indicating that firmware updates are critical to remediation. No known exploits have been reported in the wild, suggesting that exploitation may be non-trivial or not yet observed. The vulnerability primarily threatens data confidentiality by potentially exposing locked storage contents to unauthorized users with physical or local access, which is a significant concern for enterprise environments relying on these drives for sensitive data storage.

For European organizations, the primary impact of CVE-2025-12902 is the potential unauthorized disclosure of sensitive data stored on affected Solidigm DC drives, especially in environments where physical or local access controls are insufficient. This could undermine data protection obligations under GDPR and other regulations. The denial of service aspect could disrupt critical storage availability, impacting business continuity. Organizations with data centers or critical infrastructure using these drives may face increased risk of insider threats or physical attacks leading to data breaches. The requirement for high privileges and local access somewhat limits remote exploitation but does not eliminate risk from malicious insiders or attackers with physical access. The confidentiality impact is high, while integrity and availability impacts are limited. Given the medium CVSS score, the threat is moderate but significant in environments with sensitive data and less stringent physical security.

1. Immediately identify and inventory all affected Solidigm DC drives within the organization to assess exposure. 2. Apply the latest firmware updates from Solidigm that address CVE-2025-12902 as soon as they become available, ensuring all drives run versions equal to or later than ACV10360, 6DV10341, 6CV10241, 9CV10490, or 5CV10326 as applicable. 3. Strengthen physical security controls to prevent unauthorized local or physical access to storage devices, including secure data center access policies, surveillance, and tamper-evident measures. 4. Limit administrative privileges on systems interfacing with these drives to reduce the risk of privilege escalation and misuse. 5. Implement monitoring and logging for unusual access patterns or attempts to access locked storage devices. 6. Consider encryption at the file system or application level as an additional layer of data protection to mitigate risks from firmware-level vulnerabilities. 7. Conduct regular security audits and penetration tests focusing on physical and local access controls to identify potential weaknesses. 8. Educate staff about the risks of physical access attacks and enforce strict access policies.