CVE-2022-33255

Buffer over-read in Bluetooth HOST

Information disclosure due to buffer over-read in Bluetooth HOST while processing GetFolderItems and GetItemAttribute Cmds from peer device.

CVSS 3.1 · 8.2 High EPSS < 1% KEV · Not listed

Vendors

Qualcomm

Products

Apq8009 Apq8009 Firmware Ar8031 and 181 more

CVE-2022-25734

Loop with Unreachable Exit Condition in MODEM

Denial of service in modem due to missing null check while processing IP packets with padding

CVSS 3.1 · 7.5 High EPSS < 1% KEV · Not listed

Vendors

Qualcomm

Products

Ar8031 Ar8031 Firmware Csra6620 and 67 more

CVE-2022-25694

Use of Out-of-range Pointer Offset in MODEM

Memory corruption in Modem due to usage of Out-of-range pointer offset in UIM

CVSS 3.1 · 8.4 High EPSS < 1% KEV · Not listed

Vendors

Qualcomm

Products

Apq8009 Apq8009 Firmware Apq8009w and 413 more

CVE-2022-33275

Improper validation of array index in WLAN HAL

Memory corruption due to improper validation of array index in WLAN HAL when received lm_itemNum is out of range.

CVSS 3.1 · 8.4 High EPSS < 1% KEV · Not listed

Vendors

Qualcomm

Products

315 5g Iot Modem 315 5g Iot Modem Firmware Apq5053-aa and 515 more

CVE-2023-28538

Stack-based Buffer Overflow in WIN Product

Memory corruption in WIN Product while invoking WinAcpi update driver in the UEFI region.

CVSS 3.1 · 8.4 High EPSS < 1% KEV · Not listed

Vendors

Qualcomm

Products

Aqt1000 Aqt1000 Firmware Csra6620 and 257 more

CVE-2023-28544

Buffer Copy without Checking the Size of Input in WLAN Firmware

Memory corruption in WLAN while sending transmit command from HLOS to UTF handlers.

CVSS 3.1 · 7.8 High EPSS < 1% KEV · Not listed

Vendors

Qualcomm

Products

Aqt1000 Aqt1000 Firmware Ar9380 and 409 more

CVE-2023-28559

Buffer Copy Without Checking Size of Input in WLAN HAL

Memory corruption in WLAN FW while processing command parameters from untrusted WMI payload.

CVSS 3.1 · 7.8 High EPSS < 1% KEV · Not listed

Vendors

Qualcomm

Products

Aqt1000 Aqt1000 Firmware Ar8031 and 423 more

CVE-2023-28560

Buffer Copy Without Checking Size of Input in WLAN HAL

Memory corruption in WLAN HAL while processing devIndex from untrusted WMI payload.

CVSS 3.1 · 7.8 High EPSS < 1% KEV · Not listed

Vendors

Qualcomm

Products

8098 8098 Firmware 8998 and 531 more

CVE-2023-28564

Use of Out-of-range Pointer Offset in WLAN HAL

Memory corruption in WLAN HAL while passing command parameters through WMI interfaces.

CVSS 3.1 · 7.8 High EPSS < 1% KEV · Not listed

Vendors

Qualcomm

Products

Aqt1000 Aqt1000 Firmware Ar8031 and 495 more

CVE-2023-28565

Improper Validation of Array Index in WLAN HAL

Memory corruption in WLAN HAL while handling command streams through WMI interfaces.

CVSS 3.1 · 7.8 High EPSS < 1% KEV · Not listed

Vendors

Qualcomm

Products

9205 Lte 9205 Lte Firmware Apq8017 and 585 more

CVE-2023-28567

Improper Validation of Array Index in WLAN HAL

Memory corruption in WLAN HAL while handling command through WMI interfaces.

CVSS 3.1 · 7.8 High EPSS < 1% KEV · Not listed

Vendors

Qualcomm

Products

315 5g Iot 315 5g Iot Firmware Aqt1000 and 579 more

CVE-2023-28540

Improper Authentication in Data Modem

Cryptographic issue in Data Modem due to improper authentication during TLS handshake.

CVSS 3.1 · 9.1 Critical EPSS < 1% KEV · Not listed

Vendors

Qualcomm

Products

315 5g Iot Modem 315 5g Iot Modem Firmware Apq5053-aa and 301 more

CVE-2024-49834

Improper Validation of Array Index in Camera

Memory corruption while power-up or power-down sequence of the camera sensor.

CVSS 3.1 · 7.8 High EPSS < 1% KEV · Not listed

Vendors

Qualcomm

Products

Csra6620 Csra6620 Firmware Csra6640 and 251 more

CVE-2022-40507

Double free in Core

Memory corruption due to double free in Core while mapping HLOS address to the list.

CVSS 3.1 · 8.4 High EPSS 1.3% KEV · Not listed

Vendors

Qualcomm

Products

315 5g Iot Modem 315 5g Iot Modem Firmware 9205 Lte Modem and 481 more

CVE-2023-21670

Improper Access control in GPU Subsystem

Memory Corruption in GPU Subsystem due to arbitrary command execution from GPU in privileged mode.

CVSS 3.1 · 7.8 High EPSS < 1% KEV · Not listed

Vendors

Qualcomm

Products

315 5g Iot Modem 315 5g Iot Modem Firmware Aqt1000 and 361 more

CVE-2024-33012

Buffer Over-read in WLAN Host

Transient DOS while parsing the multiple MBSSID IEs from the beacon, when the tag length is non-zero value but with end of beacon.

CVSS 3.1 · 7.5 High EPSS < 1% KEV · Not listed

Vendors

Qualcomm

Products

Ar8035 Ar8035 Firmware Ar9380 and 498 more

CVE-2024-33011

Buffer Over-read in WLAN Host

Transient DOS while parsing the MBSSID IE from the beacons, when the MBSSID IE length is zero.

CVSS 3.1 · 7.5 High EPSS < 1% KEV · Not listed

Vendors

Qualcomm

Products

Ar8035 Ar8035 Firmware Ar9380 and 498 more

CVE-2024-33010

Use After Free in WLAN Host

Transient DOS while parsing fragments of MBSSID IE from beacon frame.

CVSS 3.1 · 7.5 High EPSS < 1% KEV · Not listed

Vendors

Qualcomm

Products

Ar8035 Ar8035 Firmware Ar9380 and 496 more

CVE-2024-23356

Improper Restriction of Operations within the Bounds of a Memory Buffer in HLOS

Memory corruption during session sign renewal request calls in HLOS.

CVSS 3.1 · 7.8 High EPSS < 1% KEV · Not listed

Vendors

Qualcomm

Products

Aqt1000 Aqt1000 Firmware Ar8031 and 419 more

CVE-2024-23353

Buffer Over-read in Multi Mode Call Processor

Transient DOS while decoding attach reject message received by UE, when IEI is set to ESM_IEI.

CVSS 3.1 · 7.5 High EPSS < 1% KEV · Not listed

Vendors

Qualcomm

Products

205 Mobile Platform 205 Mobile Platform Firmware 215 Mobile Platform and 499 more