Qualcomm QCA2062 Firmware vulnerabilities

83 CVEs affecting Qualcomm QCA2062 Firmware, 0 known to be exploited (CISA KEV), with EPSS scores. Latest: CVE-2026-25274, published 2026-10-06.

Highest priority

Known exploited (CISA KEV) first, then by EPSS exploit probability.

CVE-2020-11264, published 2021-09-08. Critical severity, CVSS 9.8. EPSS: 13.2% chance of exploitation in the next 30 days. Improper authentication of Non-EAPOL/WAPI plaintext frames during four-way handshake can lead to arbitrary network packet injection in Snapdragon Auto, Snapdragon Compute, Snapdragon Connectivity,…
CVE-2022-25736, published 2022-10-19. High severity, CVSS 7.5. EPSS: 0.8% chance of exploitation in the next 30 days. Denial of service in WLAN due to out-of-bound read happens while processing VHT action frame in Snapdragon Auto, Snapdragon Compute, Snapdragon Connectivity, Snapdragon Consumer Electronics…
CVE-2021-30302, published 2021-10-20. High severity, CVSS 7.5. EPSS: 0.7% chance of exploitation in the next 30 days. Improper authentication of EAP WAPI EAPOL frames from unauthenticated user can lead to information disclosure in Snapdragon Compute, Snapdragon Connectivity, Snapdragon Consumer Electronics…
CVE-2021-30304, published 2021-10-20. Critical severity, CVSS 9.1. EPSS: 0.6% chance of exploitation in the next 30 days. Possible buffer out of bound read can occur due to improper validation of TBTT count and length while parsing the beacon response in Snapdragon Compute, Snapdragon Connectivity, Snapdragon Consumer…
CVE-2021-1980, published 2021-10-20. Critical severity, CVSS 9.1. EPSS: 0.6% chance of exploitation in the next 30 days. Possible buffer over read due to lack of length check while parsing beacon IE response in Snapdragon Auto, Snapdragon Compute, Snapdragon Connectivity, Snapdragon Consumer Electronics Connectivity,…
CVE-2021-1971, published 2021-09-09. High severity, CVSS 7.5. EPSS: 0.6% chance of exploitation in the next 30 days. Possible assertion due to lack of physical layer state validation in Snapdragon Auto, Snapdragon Compute, Snapdragon Connectivity, Snapdragon Consumer Electronics Connectivity, Snapdragon Industrial…
CVE-2021-1948, published 2021-09-09. High severity, CVSS 7.5. EPSS: 0.6% chance of exploitation in the next 30 days. Possible out of bound read due to lack of length check of data while parsing the beacon or probe response in Snapdragon Auto, Snapdragon Compute, Snapdragon Connectivity, Snapdragon Consumer…
CVE-2021-1941, published 2021-09-09. High severity, CVSS 7.5. EPSS: 0.6% chance of exploitation in the next 30 days. Possible buffer over read issue due to improper length check on WPA IE string sent by peer in Snapdragon Auto, Snapdragon Compute, Snapdragon Connectivity, Snapdragon Consumer Electronics…
CVE-2021-1953, published 2021-07-13. High severity, CVSS 7.5. EPSS: 0.6% chance of exploitation in the next 30 days. Improper handling of received malformed FTMR request frame can lead to reachable assertion while responding with FTM1 frame in Snapdragon Auto, Snapdragon Compute, Snapdragon Connectivity, Snapdragon…
CVE-2021-1938, published 2021-07-13. High severity, CVSS 7.5. EPSS: 0.6% chance of exploitation in the next 30 days. Possible assertion due to improper verification while creating and deleting the peer in Snapdragon Auto, Snapdragon Compute, Snapdragon Connectivity, Snapdragon Consumer Electronics Connectivity,…

Latest

CVE-2026-25274, published 2026-10-06. Medium severity, CVSS 6.7. EPSS: 0.1% chance of exploitation in the next 30 days. Memory Corruption when processing concurrent DMA buffer allocation and deallocation commands without proper synchronization.
CVE-2026-25275, published 2026-09-17. High severity, CVSS 7.5. EPSS: 0.2% chance of exploitation in the next 30 days. Transient DOS when processing authentication frames with invalid FILS information element header lengths.
CVE-2026-24076, published 2026-08-04. Medium severity, CVSS 6.7. EPSS: 0.1% chance of exploitation in the next 30 days. Memory Corruption when processing registry values with incorrect types using a direct query method.
CVE-2025-47401, published 2026-05-04. High severity, CVSS 7.5. EPSS: 0.2% chance of exploitation in the next 30 days. Transient DOS when processing target power rate tables during channel configuration.
CVE-2025-27066, published 2025-08-06. High severity, CVSS 7.5. EPSS: 0.3% chance of exploitation in the next 30 days. Transient DOS while processing an ANQP message.
CVE-2025-21446, published 2025-07-08. High severity, CVSS 7.5. EPSS: 0.2% chance of exploitation in the next 30 days. Transient DOS may occur when processing vendor-specific information elements while parsing a WLAN frame for BTM requests.
CVE-2025-21448, published 2025-04-07. High severity, CVSS 7.5. EPSS: 0.3% chance of exploitation in the next 30 days. Transient DOS may occur while parsing SSID in action frames.
CVE-2025-21441, published 2025-04-07. High severity, CVSS 7.8. EPSS: 0.1% chance of exploitation in the next 30 days. Memory corruption when IOCTL call is invoked from user-space to write board data to WLAN driver.
CVE-2025-21440, published 2025-04-07. High severity, CVSS 7.8. EPSS: 0.1% chance of exploitation in the next 30 days. Memory corruption when IOCTL call is invoked from user-space to write board data to WLAN driver.
CVE-2024-45542, published 2025-01-06. High severity, CVSS 7.8. EPSS: 0.1% chance of exploitation in the next 30 days. Memory corruption when IOCTL call is invoked from user-space to write board data to WLAN driver.