Qualcomm QCA617 Firmware vulnerabilities

6 CVEs affecting Qualcomm QCA617 Firmware, 0 known to be exploited (CISA KEV), with EPSS scores. Latest: CVE-2020-11227, published 2021-03-17.

Highest priority

Known exploited (CISA KEV) first, then by EPSS exploit probability.

CVE-2020-11190, published 2021-03-17. Critical severity, CVSS 9.1. EPSS: 1% chance of exploitation in the next 30 days. Buffer over-read can happen while parsing received SDP values due to lack of NULL termination check on SDP in Snapdragon Auto, Snapdragon Compute, Snapdragon Connectivity, Snapdragon Consumer IOT,…
CVE-2020-11189, published 2021-03-17. Critical severity, CVSS 9.1. EPSS: 1% chance of exploitation in the next 30 days. Buffer over-read can happen while parsing received SDP values due to lack of NULL termination check on SDP in Snapdragon Auto, Snapdragon Compute, Snapdragon Connectivity, Snapdragon Consumer IOT,…
CVE-2020-11227, published 2021-03-17. Critical severity, CVSS 9.8. EPSS: 0.9% chance of exploitation in the next 30 days. Out of bound write while parsing RTT/TTY packet parsing due to lack of check of buffer size before copying into buffer in Snapdragon Auto, Snapdragon Compute, Snapdragon Connectivity, Snapdragon…
CVE-2020-11226, published 2021-03-17. High severity, CVSS 7.5. EPSS: 0.9% chance of exploitation in the next 30 days. Out of bound memory read in Data modem while unpacking data due to lack of offset length check in Snapdragon Auto, Snapdragon Compute, Snapdragon Connectivity, Snapdragon Consumer IOT, Snapdragon…
CVE-2020-11221, published 2021-03-17. Medium severity, CVSS 5.5. EPSS: 0.2% chance of exploitation in the next 30 days. Usage of syscall by non-secure entity can allow extraction of secure QTEE diagnostic information in clear text form due to insufficient checks in the syscall handler and leads to information…
CVE-2020-11199, published 2021-03-17. Medium severity, CVSS 5.5. EPSS: 0.2% chance of exploitation in the next 30 days. HLOS to access EL3 stack canary by just mapping imem region due to Improper access control and can lead to information exposure in Snapdragon Auto, Snapdragon Compute, Snapdragon Connectivity,…