Qualcomm QCA4010 Firmware vulnerabilities

25 CVEs affecting Qualcomm QCA4010 Firmware, 0 known to be exploited (CISA KEV), with EPSS scores. Latest: CVE-2023-28563, published 2023-11-07.

More from Qualcomm.

Highest priority

Known exploited (CISA KEV) first, then by EPSS exploit probability.

• CVE-2022-25719, published 2022-10-19. Critical severity, CVSS 9.1. EPSS: 0.6% chance of exploitation in the next 30 days. Information disclosure in WLAN due to improper length check while processing authentication handshake in Snapdragon Auto, Snapdragon Connectivity, Snapdragon Consumer Electronics Connectivity,…
• CVE-2022-25718, published 2022-10-19. Critical severity, CVSS 9.8. EPSS: 0.5% chance of exploitation in the next 30 days. Cryptographic issue in WLAN due to improper check on return value while authentication handshake in Snapdragon Auto, Snapdragon Connectivity, Snapdragon Consumer Electronics Connectivity, Snapdragon…
• CVE-2022-25727, published 2022-11-15. Critical severity, CVSS 9.8. EPSS: 0.4% chance of exploitation in the next 30 days. Memory Corruption in modem due to improper length check while copying into memory in Snapdragon Consumer IOT, Snapdragon Industrial IOT, Snapdragon Voice & Music
• CVE-2022-25742, published 2022-11-15. High severity, CVSS 7.5. EPSS: 0.4% chance of exploitation in the next 30 days. Denial of service in modem due to infinite loop while parsing IGMPv2 packet from server in Snapdragon Consumer IOT, Snapdragon Industrial IOT, Snapdragon Voice & Music
• CVE-2022-25734, published 2023-02-12. High severity, CVSS 7.5. EPSS: 0.4% chance of exploitation in the next 30 days. Denial of service in modem due to missing null check while processing IP packets with padding
• CVE-2022-25733, published 2023-02-12. High severity, CVSS 7.5. EPSS: 0.4% chance of exploitation in the next 30 days. Denial of service in modem due to null pointer dereference while processing DNS packets
• CVE-2022-33229, published 2023-02-12. High severity, CVSS 7.5. EPSS: 0.4% chance of exploitation in the next 30 days. Information disclosure due to buffer over-read in Modem while using static array to process IPv4 packets.
• CVE-2022-25738, published 2023-02-12. High severity, CVSS 7.5. EPSS: 0.4% chance of exploitation in the next 30 days. Information disclosure in modem due to buffer over-red while performing checksum of packet received
• CVE-2023-21625, published 2023-08-08. High severity, CVSS 7.5. EPSS: 0.4% chance of exploitation in the next 30 days. Information disclosure in Network Services due to buffer over-read while the device receives DNS response.
• CVE-2022-40505, published 2023-05-02. High severity, CVSS 7.5. EPSS: 0.4% chance of exploitation in the next 30 days. Information disclosure due to buffer over-read in Modem while parsing DNS hostname.

Latest

• CVE-2023-28563, published 2023-11-07. Medium severity, CVSS 5.5. EPSS: 0.1% chance of exploitation in the next 30 days. Information disclosure in IOE Firmware while handling WMI command.
• CVE-2023-28565, published 2023-09-05. High severity, CVSS 7.8. EPSS: 0.1% chance of exploitation in the next 30 days. Memory corruption in WLAN HAL while handling command streams through WMI interfaces.
• CVE-2023-28560, published 2023-09-05. High severity, CVSS 7.8. EPSS: 0.1% chance of exploitation in the next 30 days. Memory corruption in WLAN HAL while processing devIndex from untrusted WMI payload.
• CVE-2023-28559, published 2023-09-05. High severity, CVSS 7.8. EPSS: 0.1% chance of exploitation in the next 30 days. Memory corruption in WLAN FW while processing command parameters from untrusted WMI payload.
• CVE-2023-21628, published 2023-06-06. High severity, CVSS 7.8. EPSS: 0.1% chance of exploitation in the next 30 days. Memory corruption in WLAN HAL while processing WMI-UTF command or FTM TLV1 command.
• CVE-2022-33291, published 2023-04-13. High severity, CVSS 7.5. EPSS: 0.4% chance of exploitation in the next 30 days. Information disclosure in Modem due to buffer over-read while receiving a IP header with malformed length.
• CVE-2022-33287, published 2023-04-13. High severity, CVSS 7.5. EPSS: 0.4% chance of exploitation in the next 30 days. Information disclosure in Modem due to buffer over-read while getting length of Unfragmented headers in an IPv6 packet.
• CVE-2022-33222, published 2023-04-13. High severity, CVSS 7.5. EPSS: 0.4% chance of exploitation in the next 30 days. Information disclosure due to buffer over-read while parsing DNS response packets in Modem.