Qualcomm MDM9640 Firmware vulnerabilities

495 CVEs affecting Qualcomm MDM9640 Firmware, 0 known to be exploited (CISA KEV), with EPSS scores. Latest: CVE-2025-47383, published 2026-03-02.

Highest priority

Known exploited (CISA KEV) first, then by EPSS exploit probability.

CVE-2020-3657, published 2020-11-02. Critical severity, CVSS 9.8. EPSS: 28.3% chance of exploitation in the next 30 days. u'Remote code execution can happen by sending a carefully crafted POST query when Device configuration is accessed from a tethered client through webserver due to lack of array bound check.' in…
CVE-2020-11301, published 2021-09-08. High severity, CVSS 7.5. EPSS: 11.1% chance of exploitation in the next 30 days. Improper authentication of un-encrypted plaintext Wi-Fi frames in an encrypted network can lead to information disclosure in Snapdragon Auto, Snapdragon Compute, Snapdragon Connectivity, Snapdragon…
CVE-2019-10529, published 2019-11-06. High severity, CVSS 8.1. EPSS: 1.7% chance of exploitation in the next 30 days. Possible use after free issue due to race condition while attempting to mark the entry pages as dirty using function set_page_dirty() in Snapdragon Auto, Snapdragon Compute, Snapdragon Consumer IOT,…
CVE-2019-2307, published 2019-07-25. Critical severity, CVSS 9.8. EPSS: 1.6% chance of exploitation in the next 30 days. Possible integer underflow due to lack of validation before calculation of data length in 802.11 Rx management configuration in Snapdragon Auto, Snapdragon Consumer Electronics Connectivity,…
CVE-2019-10574, published 2020-04-16. High severity, CVSS 7.1. EPSS: 1.6% chance of exploitation in the next 30 days. Lack of boundary checks for data offsets received from HLOS can lead to out-of-bound read in Snapdragon Auto, Snapdragon Compute, Snapdragon Connectivity, Snapdragon Consumer Electronics…
CVE-2015-9201, published 2018-04-18. Critical severity, CVSS 9.8. EPSS: 1.4% chance of exploitation in the next 30 days. In Android before 2018-04-05 or earlier security patch level on Qualcomm Snapdragon Automobile, Snapdragon Mobile, and Snapdragon Wear IPQ4019, MDM9206, MDM9607, MDM9625, MDM9635M, MDM9640, MDM9645,…
CVE-2015-9122, published 2018-04-18. Critical severity, CVSS 9.8. EPSS: 1.4% chance of exploitation in the next 30 days. In Android before 2018-04-05 or earlier security patch level on Qualcomm Snapdragon Mobile and Snapdragon Wear MDM9206, MDM9607, MDM9635M, MDM9640, MDM9645, MDM9655, MSM8909W, SD 210/SD 212/SD 205,…
CVE-2016-10449, published 2018-04-18. Critical severity, CVSS 9.8. EPSS: 1.4% chance of exploitation in the next 30 days. In Android before 2018-04-05 or earlier security patch level on Qualcomm Snapdragon Mobile and Snapdragon Wear MDM9206, MDM9607, MDM9640, MDM9650, MSM8909W, SD 210/SD 212/SD 205, SD 410/12, SD 425,…
CVE-2015-9145, published 2018-04-18. Critical severity, CVSS 9.8. EPSS: 1.4% chance of exploitation in the next 30 days. In Android before 2018-04-05 or earlier security patch level on Qualcomm Snapdragon Automobile, Snapdragon Mobile, and Snapdragon Wear MDM9206, MDM9607, MDM9635M, MDM9640, MDM9645, MDM9650, MDM9655,…
CVE-2014-10054, published 2018-04-18. Critical severity, CVSS 9.8. EPSS: 1.4% chance of exploitation in the next 30 days. In Android before 2018-04-05 or earlier security patch level on Qualcomm Snapdragon Automobile, Snapdragon Mobile, and Snapdragon Wear MDM9206, MDM9607, MDM9635M, MDM9640, MDM9650, MSM8909W,…

Latest

CVE-2025-47383, published 2026-03-02. High severity, CVSS 7.2. EPSS: 0.1% chance of exploitation in the next 30 days. Weak configuration may lead to cryptographic issue when a VoWiFi call is triggered from UE.
CVE-2025-47320, published 2025-12-18. High severity, CVSS 7.8. EPSS: 0.1% chance of exploitation in the next 30 days. Memory corruption while processing MFC channel configuration during music playback.
CVE-2025-27074, published 2025-11-04. High severity, CVSS 7.8. EPSS: 0.1% chance of exploitation in the next 30 days. Memory corruption while processing a GP command response.
CVE-2025-27053, published 2025-10-09. High severity, CVSS 7.8. EPSS: 0.1% chance of exploitation in the next 30 days. Memory corruption during PlayReady APP usecase while processing TA commands.
CVE-2025-47318, published 2025-09-24. High severity, CVSS 7.5. EPSS: 0.2% chance of exploitation in the next 30 days. Transient DOS while parsing the EPTM test control message to get the test pattern.
CVE-2025-21482, published 2025-09-24. High severity, CVSS 7.1. EPSS: 0.1% chance of exploitation in the next 30 days. Cryptographic issue while performing RSA PKCS padding decoding.
CVE-2025-21430, published 2025-04-07. High severity, CVSS 7.5. EPSS: 0.3% chance of exploitation in the next 30 days. Transient DOS while connecting STA to AP and initiating ADD TS request from AP to establish TSpec session.
CVE-2025-21429, published 2025-04-07. High severity, CVSS 7.5. EPSS: 0.3% chance of exploitation in the next 30 days. Memory corruption occurs while connecting a STA to an AP and initiating an ADD TS request.
CVE-2025-21428, published 2025-04-07. High severity, CVSS 7.5. EPSS: 0.3% chance of exploitation in the next 30 days. Memory corruption occurs while connecting a STA to an AP and initiating an ADD TS request from the AP to establish a TSpec session.
CVE-2024-53027, published 2025-03-03. High severity, CVSS 7.5. EPSS: 0.3% chance of exploitation in the next 30 days. Transient DOS may occur while processing the country IE.