Qualcomm MDM915 Firmware vulnerabilities

2 CVEs affecting Qualcomm MDM915 Firmware, 0 known to be exploited (CISA KEV), with EPSS scores. Latest: CVE-2019-2289, published 2019-11-21.

More from Qualcomm.

Highest priority

Known exploited (CISA KEV) first, then by EPSS exploit probability.

• CVE-2019-2271, published 2019-11-21. Critical severity, CVSS 9.8. EPSS: 1.1% chance of exploitation in the next 30 days. Buffer over read can happen while parsing downlink session management OTA messages if network sends un-intended values in Snapdragon Auto, Snapdragon Compute, Snapdragon Consumer IOT, Snapdragon…
• CVE-2019-2289, published 2019-11-21. Critical severity, CVSS 9.8. EPSS: 0.6% chance of exploitation in the next 30 days. Lack of integrity check allows MODEM to accept any NAS messages which can result into authentication bypass of NAS in Snapdragon Auto, Snapdragon Compute, Snapdragon Consumer IOT, Snapdragon…