Qualcomm IPQ5302 Firmware vulnerabilities

71 CVEs affecting Qualcomm IPQ5302 Firmware, 0 known to be exploited (CISA KEV), with EPSS scores. Latest: CVE-2026-25275, published 2026-09-17.

More from Qualcomm.

Highest priority

Known exploited (CISA KEV) first, then by EPSS exploit probability.

• CVE-2023-33105, published 2024-03-04. High severity, CVSS 7.5. EPSS: 0.8% chance of exploitation in the next 30 days. Transient DOS in WLAN Host and Firmware when large number of open authentication frames are sent with an invalid transaction sequence number.
• CVE-2024-21473, published 2024-04-01. Critical severity, CVSS 9.8. EPSS: 0.7% chance of exploitation in the next 30 days. Memory corruption while redirecting log file to any file location with any file name.
• CVE-2024-33066, published 2024-10-07. Critical severity, CVSS 9.8. EPSS: 0.6% chance of exploitation in the next 30 days. Memory corruption while redirecting log file to any file location with any file name.
• CVE-2024-45569, published 2025-02-03. Critical severity, CVSS 9.8. EPSS: 0.6% chance of exploitation in the next 30 days. Memory corruption while parsing the ML IE due to invalid frame content.
• CVE-2024-45558, published 2025-01-06. High severity, CVSS 7.5. EPSS: 0.4% chance of exploitation in the next 30 days. Transient DOS can occur when the driver parses the per STA profile IE and tries to access the EXTN element ID without checking the IE length.
• CVE-2023-43553, published 2024-03-04. Critical severity, CVSS 9.8. EPSS: 0.4% chance of exploitation in the next 30 days. Memory corruption while parsing beacon/probe response frame when AP sends more supported links in MLIE.
• CVE-2023-43552, published 2024-03-04. Critical severity, CVSS 9.8. EPSS: 0.4% chance of exploitation in the next 30 days. Memory corruption while processing MBSSID beacon containing several subelement IE.
• CVE-2024-33073, published 2024-10-07. High severity, CVSS 8.2. EPSS: 0.3% chance of exploitation in the next 30 days. Information disclosure while parsing the BSS parameter change count or MLD capabilities fields of the ML IE.
• CVE-2024-33018, published 2024-08-05. High severity, CVSS 7.5. EPSS: 0.3% chance of exploitation in the next 30 days. Transient DOS while parsing the received TID-to-link mapping element of the TID-to-link mapping action frame.
• CVE-2024-38397, published 2024-10-07. High severity, CVSS 7.5. EPSS: 0.3% chance of exploitation in the next 30 days. Transient DOS while parsing probe response and assoc response frame.

Latest

• CVE-2026-25275, published 2026-09-17. High severity, CVSS 7.5. EPSS: 0.2% chance of exploitation in the next 30 days. Transient DOS when processing authentication frames with invalid FILS information element header lengths.
• CVE-2026-25289, published 2026-08-04. Critical severity, CVSS 9.6. EPSS: 0.2% chance of exploitation in the next 30 days. Memory Corruption when processing Device Capability Extended attributes in certain NAN Service Discovery Frames with invalid length values.
• CVE-2026-25268, published 2026-07-06. High severity, CVSS 8.8. EPSS: 0.1% chance of exploitation in the next 30 days. Memory Corruption when processing invalid HT40 channel layouts during dynamic channel switching operations.
• CVE-2025-59609, published 2026-06-01. Medium severity, CVSS 5.5. EPSS: 0.1% chance of exploitation in the next 30 days. Information Disclosure when processing advertisement frames with malformed MBSSID elements of insufficient length.
• CVE-2025-47403, published 2026-05-04. High severity, CVSS 7.5. EPSS: 0.2% chance of exploitation in the next 30 days. Transient DOS when processing a malformed Fast Transition response frame with an invalid header structure during wireless roaming.
• CVE-2025-47401, published 2026-05-04. High severity, CVSS 7.5. EPSS: 0.2% chance of exploitation in the next 30 days. Transient DOS when processing target power rate tables during channel configuration.
• CVE-2025-47331, published 2026-01-07. Medium severity, CVSS 6.1. EPSS: 0.1% chance of exploitation in the next 30 days. Information disclosure while processing a firmware event.
• CVE-2025-27064, published 2025-11-04. Medium severity, CVSS 6.1. EPSS: 0.1% chance of exploitation in the next 30 days. Information disclosure while registering commands from clients with diag through diagHal.
• CVE-2025-47328, published 2025-09-24. High severity, CVSS 7.5. EPSS: 0.2% chance of exploitation in the next 30 days. Transient DOS while processing power control requests with invalid antenna or stream values.
• CVE-2025-47326, published 2025-09-24. High severity, CVSS 7.5. EPSS: 0.2% chance of exploitation in the next 30 days. Transient DOS while handling command data during power control processing.