CVE-2023-28567

Improper Validation of Array Index in WLAN HAL

Memory corruption in WLAN HAL while handling command through WMI interfaces.

CVSS 3.1 · 7.8 High EPSS < 1% KEV · Not listed

Vendors

Qualcomm

Products

315 5g Iot 315 5g Iot Firmware Aqt1000 and 579 more

CVE-2023-24844

Improper Access Control in Core

Memory Corruption in Core while invoking a call to Access Control core library with hardware protected address range.

CVSS 3.1 · 8.4 High EPSS < 1% KEV · Not listed

Vendors

Qualcomm

Products

Ar8035 Ar8035 Firmware Fastconnect 6700 and 83 more

CVE-2023-28540

Improper Authentication in Data Modem

Cryptographic issue in Data Modem due to improper authentication during TLS handshake.

CVSS 3.1 · 9.1 Critical EPSS < 1% KEV · Not listed

Vendors

Qualcomm

Products

315 5g Iot Modem 315 5g Iot Modem Firmware Apq5053-aa and 301 more

CVE-2024-45571

Use After Free in WLAN Host Communication

Memory corruption may occour occur when stopping the WLAN interface after processing a WMI command from the interface.

CVSS 3.1 · 7.8 High EPSS < 1% KEV · Not listed

Vendors

Qualcomm

Products

Ar8035 Ar8035 Firmware Csr8811 and 297 more

CVE-2024-49838

Buffer Over-read in WLAN HOST

Information disclosure while parsing the OCI IE with invalid length.

CVSS 3.1 · 8.2 High EPSS < 1% KEV · Not listed

Vendors

Qualcomm

Products

Ar8035 Ar8035 Firmware Fastconnect 6200 and 335 more

CVE-2024-21477

Buffer Over-read in WLAN Firmware

Transient DOS while parsing a protected 802.11az Fine Time Measurement (FTM) frame.

CVSS 3.1 · 7.5 High EPSS < 1% KEV · Not listed

Vendors

Qualcomm

Products

Aqt1000 Aqt1000 Firmware Ar8035 and 365 more

CVE-2024-21463

Buffer Copy Without Checking Size of Input in Audio

Memory corruption while processing Codec2 during v13k decoder pitch synthesis.

CVSS 3.1 · 7.3 High EPSS < 1% KEV · Not listed

Vendors

Qualcomm

Products

Ar8035 Ar8035 Firmware Fastconnect 6200 and 215 more

CVE-2024-21473

Improper Input Validation in WIN SON

Memory corruption while redirecting log file to any file location with any file name.

CVSS 3.1 · 9.8 Critical EPSS < 1% KEV · Not listed

Vendors

Qualcomm

Products

Ar8035 Ar8035 Firmware Ar9380 and 251 more

CVE-2023-33100

Improper input validation in Multi-Mode Call Processor

Transient DOS while processing DL NAS Transport message when message ID is not defined in the 3GPP specification.

CVSS 3.1 · 7.5 High EPSS < 1% KEV · Not listed

Vendors

Qualcomm

Products

Ar8035 Ar8035 Firmware Fastconnect 6700 and 97 more

CVE-2023-43549

Stack-based Buffer Overflow in WLAN HAL

Memory corruption while processing TPC target power table in FTM TPC.

CVSS 3.1 · 8.4 High EPSS < 1% KEV · Not listed

Vendors

Qualcomm

Products

Ar8035 Ar8035 Firmware Csr8811 and 275 more

CVE-2023-43539

Buffer Over-read in WLAN Firmware

Transient DOS while processing an improperly formatted 802.11az Fine Time Measurement protocol frame.

CVSS 3.1 · 7.5 High EPSS < 1% KEV · Not listed

Vendors

Qualcomm

Products

Ar8035 Ar8035 Firmware Csr8811 and 271 more

CVE-2023-33105

Configuration Issue in WLAN Host and Firmware

Transient DOS in WLAN Host and Firmware when large number of open authentication frames are sent with an invalid transaction sequence number.

CVSS 3.1 · 7.5 High EPSS < 1% KEV · Not listed

Vendors

Qualcomm

Products

Ar8035 Ar8035 Firmware Ar9380 and 295 more

CVE-2023-33103

Improper Input Validation in Multi-Mode Call Processor

Transient DOS while processing CAG info IE received from NW.

CVSS 3.1 · 7.5 High EPSS < 1% KEV · Not listed

Vendors

Qualcomm

Products

Ar8035 Ar8035 Firmware Fastconnect 6700 and 93 more

CVE-2023-33084

Improper Release of Memory Before Removing Last Reference in Data Modem

Transient DOS while processing IE fragments from server during DTLS handshake.

CVSS 3.1 · 7.5 High EPSS < 1% KEV · Not listed

Vendors

Qualcomm

Products

Ar8035 Ar8035 Firmware Fastconnect 6700 and 81 more

CVE-2023-28582

Buffer Copy Without Checking Size of Input in Data Modem

Memory corruption in Data Modem while verifying hello-verify message during the DTLS handshake.

CVSS 3.1 · 9.8 Critical EPSS < 1% KEV · Not listed

Vendors

Qualcomm

Products

Ar8035 Ar8035 Firmware Fastconnect 6700 and 83 more

CVE-2024-23363

Buffer Over-read in WLAN Firmware

Transient DOS while processing an improperly formatted Fine Time Measurement (FTM) management frame.

CVSS 3.1 · 7.5 High EPSS < 1% KEV · Not listed

Vendors

Qualcomm

Products

Ar8035 Ar8035 Firmware Csr8811 and 247 more

CVE-2023-43553

Use of Out-of-range Pointer Offset in WLAN HOST

Memory corruption while parsing beacon/probe response frame when AP sends more supported links in MLIE.

CVSS 3.1 · 9.8 Critical EPSS < 1% KEV · Not listed

Vendors

Qualcomm

Products

Ar8035 Ar8035 Firmware Csr8811 and 259 more

CVE-2022-40507

Double free in Core

Memory corruption due to double free in Core while mapping HLOS address to the list.

CVSS 3.1 · 8.4 High EPSS 1.3% KEV · Not listed

Vendors

Qualcomm

Products

315 5g Iot Modem 315 5g Iot Modem Firmware 9205 Lte Modem and 481 more

CVE-2023-21670

Improper Access control in GPU Subsystem

Memory Corruption in GPU Subsystem due to arbitrary command execution from GPU in privileged mode.

CVSS 3.1 · 7.8 High EPSS < 1% KEV · Not listed

Vendors

Qualcomm

Products

315 5g Iot Modem 315 5g Iot Modem Firmware Aqt1000 and 361 more

CVE-2023-33083

Buffer Copy Without Checking Size of Input (`Classic Buffer Overflow`) in WLAN Host

Memory corruption in WLAN Host while processing RRM beacon on the AP.

CVSS 3.1 · 9.8 Critical EPSS < 1% KEV · Not listed

Vendors

Qualcomm

Products

Ar8035 Ar8035 Firmware Ar9380 and 227 more