CVE-2023-21671

Improper Input Validation in Core

Memory Corruption in Core during syscall for Sectools Fuse comparison feature.

CVSS 3.1 · 9.3 Critical EPSS < 1% KEV · Not listed

Vendors

Qualcomm

Products

Fastconnect 6700 Fastconnect 6700 Firmware Fastconnect 6900 and 45 more

CVE-2023-43511

Loop with Unreachable Exit Condition (Infinite Loop) in WLAN Firmware

Transient DOS while parsing IPv6 extension header when WLAN firmware receives an IPv6 packet that contains `IPPROTO_NONE` as the next header.

CVSS 3.1 · 7.5 High EPSS < 1% KEV · Not listed

Vendors

Qualcomm

Products

315 5g Iot Modem 315 5g Iot Modem Firmware 9206 Lte Modem and 709 more

CVE-2023-33057

Improper Input Validation in Multi-Mode Call Processor

Transient DOS in Multi-Mode Call Processor while processing UE policy container.

CVSS 3.1 · 7.5 High EPSS < 1% KEV · Not listed

Vendors

Qualcomm

Products

315 5g Iot Modem 315 5g Iot Modem Firmware Ar8035 and 199 more

CVE-2023-33068

Buffer Copy Without Checking Size of Input in Audio

Memory corruption in Audio while processing IIR config data from AFE calibration block.

CVSS 3.1 · 6.7 Medium EPSS < 1% KEV · Not listed

Vendors

Qualcomm

Products

9206 Lte Modem 9206 Lte Modem Firmware Aqt1000 and 223 more

CVE-2023-33098

Buffer Over-read in WLAN Firmware

Transient DOS while parsing WPA IES, when it is passed with length more than expected size.

CVSS 3.1 · 7.5 High EPSS < 1% KEV · Not listed

Vendors

Qualcomm

Products

315 5g Iot Modem 315 5g Iot Modem Firmware Aqt1000 and 523 more

CVE-2023-43522

NULL Pointer Dereference in WLAN Firmware

Transient DOS while key unwrapping process, when the given encrypted key is empty or NULL.

CVSS 3.1 · 7.5 High EPSS < 1% KEV · Not listed

Vendors

Qualcomm

Products

Aqt1000 Aqt1000 Firmware Ar8035 and 569 more

CVE-2023-28551

Improper Restriction of Operations within the Bounds of a Memory Buffer in UTILS

Memory corruption in UTILS when modem processes memory specific Diag commands having arbitrary address values as input arguments.

CVSS 3.1 · 7.8 High EPSS < 1% KEV · Not listed

Vendors

Qualcomm

Products

315 5g Iot Modem 315 5g Iot Modem Firmware 9205 Lte Modem and 493 more

CVE-2023-33118

Use After Free in Automotive Audio

Memory corruption while processing Listen Sound Model client payload buffer when there is a request for Listen Sound session get parameter from ST HAL.

CVSS 3.1 · 7.8 High EPSS < 1% KEV · Not listed

Vendors

Qualcomm

Products

Ar8035 Ar8035 Firmware Csra6620 and 268 more

CVE-2023-43533

Buffer Over-read in WLAN Firmware

Transient DOS in WLAN Firmware when the length of received beacon is less than length of ieee802.11 beacon frame.

CVSS 3.1 · 7.5 High EPSS < 1% KEV · Not listed

Vendors

Qualcomm

Products

315 5g Iot Modem 315 5g Iot Modem Firmware Aqt1000 and 473 more

CVE-2024-33042

Buffer Copy Without Checking Size of Input (`Classic Buffer Overflow`) in FM Host

Memory corruption when Alternative Frequency offset value is set to 255.

CVSS 3.1 · 7.8 High EPSS < 1% KEV · Not listed

Vendors

Qualcomm

Products

205 205 Firmware 215 and 453 more

CVE-2024-33050

Buffer Over-read in WLAN Host Communication

Transient DOS while parsing MBSSID during new IE generation in beacon/probe frame when IE length check is either missing or improper.

CVSS 3.1 · 7.5 High EPSS < 1% KEV · Not listed

Vendors

Qualcomm

Products

Ar8035 Ar8035 Firmware Ar9380 and 538 more

CVE-2023-33072

Buffer copy without checking size of Input in Core

Memory corruption in Core while processing control functions.

CVSS 3.1 · 9.3 Critical EPSS < 1% KEV · Not listed

Vendors

Qualcomm

Products

315 5g Iot Modem 315 5g Iot Modem Firmware 9205 Lte Modem and 487 more

CVE-2023-33092

Buffer Copy Without Checking Size of Input in Bluetooth HOST

Memory corruption while processing pin reply in Bluetooth, when pin code received from APP layer is greater than expected size.

CVSS 3.1 · 8.4 High EPSS < 1% KEV · Not listed

Vendors

Qualcomm

Products

Aqt1000 Aqt1000 Firmware Fastconnect 6200 and 187 more

CVE-2023-33117

Use After Free in Audio

Memory corruption when HLOS allocates the response payload buffer to copy the data received from ADSP in response to AVCS_LOAD_MODULE command.

CVSS 3.1 · 7.8 High EPSS < 1% KEV · Not listed

Vendors

Qualcomm

Products

Ar8035 Ar8035 Firmware Csra6620 and 279 more

CVE-2023-33120

Use After Free in Audio

Memory corruption in Audio when memory map command is executed consecutively in ADSP.

CVSS 3.1 · 7.8 High EPSS < 1% KEV · Not listed

Vendors

Qualcomm

Products

315 5g Iot Modem 315 5g Iot Modem Firmware 9206 Lte Modem and 461 more

CVE-2024-38402

Use After Free in DSP Services

Memory corruption while processing IOCTL call for getting group info.

CVSS 3.1 · 7.8 High EPSS < 1% KEV · Not listed

Vendors

Qualcomm

Products

Ar8035 Ar8035 Firmware Csra6620 and 359 more

CVE-2023-28587

Improper Restriction of Operations within the Bounds of a Memory Buffer in BT Controller

Memory corruption in BT controller while parsing debug commands with specific sub-opcodes at HCI interface level.

CVSS 3.1 · 7.8 High EPSS < 1% KEV · Not listed

Vendors

Qualcomm

Products

315 5g Iot Modem 315 5g Iot Modem Firmware Aqt1000 and 377 more

CVE-2023-33065

Buffer Over-read in Audio

Information disclosure in Audio while accessing AVCS services from ADSP payload.

CVSS 3.1 · 6.1 Medium EPSS < 1% KEV · Not listed

Vendors

Qualcomm

Products

Aqt1000 Aqt1000 Firmware Ar8035 and 205 more

CVE-2023-33067

Use of Out-of-range Pointer Offset in Audio

Memory corruption in Audio while calling START command on host voice PCM multiple times for the same RX or TX tap points.

CVSS 3.1 · 6.7 Medium EPSS < 1% KEV · Not listed

Vendors

Qualcomm

Products

9206 Lte Modem 9206 Lte Modem Firmware Aqt1000 and 225 more

CVE-2023-33113

Buffer Copy Without Checking Size of Input (`Classic Buffer Overflow`) in Kernel

Memory corruption when resource manager sends the host kernel a reply message with multiple fragments.

CVSS 3.1 · 8.4 High EPSS < 1% KEV · Not listed

Vendors

Qualcomm

Products

Ar8035 Ar8035 Firmware Csra6620 and 251 more