This vulnerability (CVE-2025-62619) is classified as CWE-306 (Missing Authentication for Critical Function) and affects AMD Ryzen™ 4000 Series Mobile Processors with Radeon™ Graphics. The issue arises from a lack of authentication on the KVM key download endpoint, which could allow an unauthenticated attacker with knowledge of the endpoint URL to access sensitive cryptographic keys. This exposure could lead to loss of confidentiality of those keys. The CVSS 4.0 vector indicates network attack vector, low attack complexity, no privileges required, no user interaction, and low impact on confidentiality. No vendor-provided patch or mitigation is currently documented.

An attacker who discovers the exposed KVM key download endpoint URL can retrieve sensitive keys without authentication, potentially compromising the confidentiality of those keys. This could undermine the security of cryptographic operations relying on these keys. There is no evidence of known exploitation in the wild. The impact is limited to confidentiality loss; integrity and availability impacts are not indicated.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since no official patch or remediation level is provided by AMD, users should monitor AMD's security advisories for updates. Until a fix is available, restricting access to the affected endpoint and ensuring that the URL is not exposed or guessable may reduce risk. No vendor-stated 'no action required' or 'already mitigated' status is present.