CVE-2019-14054: Qualcomm Kamorta Firmware

High severity, CVSS 7.8. EPSS: 0.2% chance of exploitation in the next 30 days.

Improper permissions in XBL_SEC region enable user to update XBL_SEC code and data and divert the RAM dump path to normal cold boot path in Snapdragon Compute, Snapdragon Consumer IOT, Snapdragon Industrial IOT, Snapdragon Mobile, Snapdragon Wired Infrastructure and Networking in Kamorta, MSM8998, QCS404, QCS605, SDA660, SDA845, SDM630, SDM636, SDM660, SDM670, SDM710, SDM845, SDM850, SM8150, SXR1130, SXR2130

Affected products

• Qualcomm Kamorta Firmware: affected versions not specified
• Qualcomm MSM8998 Firmware: affected versions not specified
• Qualcomm QCS404 Firmware: affected versions not specified
• Qualcomm QCS605 Firmware: affected versions not specified
• Qualcomm SDA660 Firmware: affected versions not specified
• Qualcomm SDA845 Firmware: affected versions not specified
• Qualcomm SDM630 Firmware: affected versions not specified
• Qualcomm SDM636 Firmware: affected versions not specified
• Qualcomm SDM660 Firmware: affected versions not specified
• Qualcomm SDM670 Firmware: affected versions not specified
• Qualcomm SDM710 Firmware: affected versions not specified
• Qualcomm SDM845 Firmware: affected versions not specified
• Qualcomm SDM850 Firmware: affected versions not specified
• Qualcomm SM8150 Firmware: affected versions not specified
• Qualcomm SXR1130 Firmware: affected versions not specified
• Qualcomm SXR2130 Firmware: affected versions not specified

Published 2020-06-02. Last modified 2026-06-17.