CVE-2024-38408

Cryptographic Issues in BT Controller

Cryptographic issue when a controller receives an LMP start encryption command under unexpected conditions.

CVSS 3.1 · 8.2 High EPSS < 1% KEV · Not listed

Vendors

Qualcomm

Products

315 5g Iot Modem 315 5g Iot Modem Firmware Aqt1000 and 470 more

CVE-2022-33252

Buffer over-read in WLAN

Information disclosure due to buffer over-read in WLAN while handling IBSS beacons frame.

CVSS 3.1 · 8.2 High EPSS < 1% KEV · Not listed

Vendors

Qualcomm

Products

Aqt1000 Aqt1000 Firmware Ar8035 and 319 more

CVE-2025-21440

Out-of-bounds Read in Windows WLAN Host

Memory corruption when IOCTL call is invoked from user-space to write board data to WLAN driver.

CVSS 3.1 · 7.8 High EPSS < 1% KEV · Not listed

Vendors

Qualcomm

Products

Aqt1000 Aqt1000 Firmware Fastconnect 6200 and 95 more

CVE-2025-21441

Out-of-bounds Read in Windows WLAN Host

Memory corruption when IOCTL call is invoked from user-space to write board data to WLAN driver.

CVSS 3.1 · 7.8 High EPSS < 1% KEV · Not listed

Vendors

Qualcomm

Products

Aqt1000 Aqt1000 Firmware Fastconnect 6200 and 95 more

CVE-2024-21476

Improper Input Validation in Secure Processor

Memory corruption when the channel ID passed by user is not validated and further used.

CVSS 3.1 · 7.8 High EPSS < 1% KEV · Not listed

Vendors

Qualcomm

Products

Aqt1000 Aqt1000 Firmware Ar8035 and 100 more

CVE-2025-47318

Buffer Over-read in BT Controller

Transient DOS while parsing the EPTM test control message to get the test pattern.

CVSS 3.1 · 7.5 High EPSS < 1% KEV · Not listed

Vendors

Qualcomm

Products

Apq8017 Apq8017 Firmware Apq8064au and 404 more

CVE-2025-27066

Reachable Assertion in WLAN Firmware

Transient DOS while processing an ANQP message.

CVSS 3.1 · 7.5 High EPSS < 1% KEV · Not listed

Vendors

Qualcomm

Products

315 5g Iot Modem 315 5g Iot Modem Firmware Aqt1000 and 742 more

CVE-2025-21448

Buffer Over-read in WLAN Firmware

Transient DOS may occur while parsing SSID in action frames.

CVSS 3.1 · 7.5 High EPSS < 1% KEV · Not listed

Vendors

Qualcomm

Products

315 5g Iot Modem 315 5g Iot Modem Firmware Aqt1000 and 535 more

CVE-2023-33080

Buffer over-read in WLAN Firmware

Transient DOS while parsing a vender specific IE (Information Element) of reassociation response management frame.

CVSS 3.1 · 7.5 High EPSS < 1% KEV · Not listed

Vendors

Qualcomm

Products

315 5g Iot Modem 315 5g Iot Modem Firmware 8098 and 730 more

CVE-2023-33062

Buffer Over-read in WLAN Firmware

Transient DOS in WLAN Firmware while parsing a BTM request.

CVSS 3.1 · 7.5 High EPSS < 1% KEV · Not listed

Vendors

Qualcomm

Products

315 5g Iot Modem 315 5g Iot Modem Firmware Aqt1000 and 577 more

CVE-2023-43533

Buffer Over-read in WLAN Firmware

Transient DOS in WLAN Firmware when the length of received beacon is less than length of ieee802.11 beacon frame.

CVSS 3.1 · 7.5 High EPSS < 1% KEV · Not listed

Vendors

Qualcomm

Products

315 5g Iot Modem 315 5g Iot Modem Firmware Aqt1000 and 473 more

CVE-2023-43522

NULL Pointer Dereference in WLAN Firmware

Transient DOS while key unwrapping process, when the given encrypted key is empty or NULL.

CVSS 3.1 · 7.5 High EPSS < 1% KEV · Not listed

Vendors

Qualcomm

Products

Aqt1000 Aqt1000 Firmware Ar8035 and 569 more

CVE-2023-43536

Buffer Over-read in WLAN Firmware

Transient DOS while parse fils IE with length equal to 1.

CVSS 3.1 · 7.5 High EPSS < 1% KEV · Not listed

Vendors

Qualcomm

Products

315 5g Iot Modem 315 5g Iot Modem Firmware Aqt1000 and 615 more

CVE-2023-33089

NULL Pointer Dereference in WLAN Firmware

Transient DOS when processing a NULL buffer while parsing WLAN vdev.

CVSS 3.1 · 7.5 High EPSS < 1% KEV · Not listed

Vendors

Qualcomm

Products

315 5g Iot Modem 315 5g Iot Modem Firmware Aqt1000 and 453 more

CVE-2023-33098

Buffer Over-read in WLAN Firmware

Transient DOS while parsing WPA IES, when it is passed with length more than expected size.

CVSS 3.1 · 7.5 High EPSS < 1% KEV · Not listed

Vendors

Qualcomm

Products

315 5g Iot Modem 315 5g Iot Modem Firmware Aqt1000 and 523 more

CVE-2023-33088

NULL pointer dereference in WLAN Firmware

Memory corruption when processing cmd parameters while parsing vdev.

CVSS 3.1 · 8.4 High EPSS < 1% KEV · Not listed

Vendors

Qualcomm

Products

315 5g Iot Modem 315 5g Iot Modem Firmware Aqt1000 and 609 more

CVE-2023-43511

Loop with Unreachable Exit Condition (Infinite Loop) in WLAN Firmware

Transient DOS while parsing IPv6 extension header when WLAN firmware receives an IPv6 packet that contains `IPPROTO_NONE` as the next header.

CVSS 3.1 · 7.5 High EPSS < 1% KEV · Not listed

Vendors

Qualcomm

Products

315 5g Iot Modem 315 5g Iot Modem Firmware 9206 Lte Modem and 709 more

CVE-2023-33027

Buffer Over-read in WLAN Firmware

Transient DOS in WLAN Firmware while parsing rsn ies.

CVSS 3.1 · 7.5 High EPSS < 1% KEV · Not listed

Vendors

Qualcomm

Products

315 5g Iot Modem 315 5g Iot Modem Firmware 8098 and 680 more

CVE-2023-33109

NULL Pointer Dereference in WLAN Firmware

Transient DOS while processing a WMI P2P listen start command (0xD00A) sent from host.

CVSS 3.1 · 7.5 High EPSS < 1% KEV · Not listed

Vendors

Qualcomm

Products

315 5g Iot Modem 315 5g Iot Modem Firmware Aqt1000 and 617 more

CVE-2024-45541

Buffer Copy Without Checking Size of Input (`Classic Buffer Overflow`) in WLAN Windows Host

Memory corruption when IOCTL call is invoked from user-space to read board data.

CVSS 3.1 · 7.8 High EPSS < 1% KEV · Not listed

Vendors

Qualcomm

Products

Aqt1000 Aqt1000 Firmware Fastconnect 6200 and 99 more