Qualcomm QCN7605 Firmware vulnerabilities

192 CVEs affecting Qualcomm QCN7605 Firmware, 0 known to be exploited (CISA KEV), with EPSS scores. Latest: CVE-2026-25275, published 2026-09-17.

Highest priority

Known exploited (CISA KEV) first, then by EPSS exploit probability.

CVE-2020-11301, published 2021-09-08. High severity, CVSS 7.5. EPSS: 11.1% chance of exploitation in the next 30 days. Improper authentication of un-encrypted plaintext Wi-Fi frames in an encrypted network can lead to information disclosure in Snapdragon Auto, Snapdragon Compute, Snapdragon Connectivity, Snapdragon…
CVE-2020-11153, published 2020-11-02. Critical severity, CVSS 9.8. EPSS: 2.3% chance of exploitation in the next 30 days. u'Out of bound memory access while processing GATT data received due to lack of check of pdu data length and leads to remote code execution' in Snapdragon Auto, Snapdragon Compute, Snapdragon…
CVE-2021-30317, published 2022-02-11. High severity, CVSS 7.8. EPSS: 1.4% chance of exploitation in the next 30 days. Improper validation of program headers containing ELF metadata can lead to image verification bypass in Snapdragon Auto, Snapdragon Compute, Snapdragon Connectivity, Snapdragon Consumer Electronics…
CVE-2019-10557, published 2019-12-18. Critical severity, CVSS 9.8. EPSS: 1.1% chance of exploitation in the next 30 days. Out-of-bound read in the wireless driver in the Linux kernel due to lack of check of buffer length. in Snapdragon Auto, Snapdragon Consumer Electronics Connectivity, Snapdragon Consumer IOT,…
CVE-2020-3669, published 2020-09-08. Critical severity, CVSS 9.8. EPSS: 1.1% chance of exploitation in the next 30 days. u'Buffer Overflow issue in WLAN tcp ip verification due to usage of out of range pointer offset' in Snapdragon Auto, Snapdragon Compute, Snapdragon Connectivity, Snapdragon Consumer Electronics…
CVE-2020-3675, published 2020-09-08. Critical severity, CVSS 9.8. EPSS: 1.1% chance of exploitation in the next 30 days. u'Potential integer underflow while parsing Service Info and IPv6 link-local TLVs that comes as part of NDPE attribute' in Snapdragon Auto, Snapdragon Compute, Snapdragon Connectivity, Snapdragon…
CVE-2020-3668, published 2020-09-08. Critical severity, CVSS 9.8. EPSS: 1.1% chance of exploitation in the next 30 days. u'Buffer overflow while parsing PMF enabled MCBC frames due to frame length being lesser than what is expected while parsing' in Snapdragon Auto, Snapdragon Compute, Snapdragon Connectivity,…
CVE-2019-14083, published 2020-03-05. Critical severity, CVSS 9.8. EPSS: 1% chance of exploitation in the next 30 days. While parsing Service Descriptor Extended Attribute received as part of SDF frame, there is a possibility that incorrect length is specified in the attribute length field of extended SSI which can…
CVE-2020-3699, published 2020-07-30. Critical severity, CVSS 9.8. EPSS: 0.9% chance of exploitation in the next 30 days. Possible out of bound access while processing assoc response from host due to improper length check before copying into buffer in Snapdragon Auto, Snapdragon Compute, Snapdragon Consumer Electronics…
CVE-2020-11116, published 2020-09-08. Critical severity, CVSS 9.8. EPSS: 0.9% chance of exploitation in the next 30 days. u'Possible out of bound write while processing association response received from host due to lack of check of IE length' in Snapdragon Auto, Snapdragon Compute, Snapdragon Consumer Electronics…

Latest

CVE-2026-25275, published 2026-09-17. High severity, CVSS 7.5. EPSS: 0.2% chance of exploitation in the next 30 days. Transient DOS when processing authentication frames with invalid FILS information element header lengths.
CVE-2025-47370, published 2025-11-04. Medium severity, CVSS 6.5. EPSS: 0.1% chance of exploitation in the next 30 days. Transient DOS when a remote device sends an invalid connection request during BT connectable LE scan.
CVE-2025-47318, published 2025-09-24. High severity, CVSS 7.5. EPSS: 0.2% chance of exploitation in the next 30 days. Transient DOS while parsing the EPTM test control message to get the test pattern.
CVE-2025-27066, published 2025-08-06. High severity, CVSS 7.5. EPSS: 0.3% chance of exploitation in the next 30 days. Transient DOS while processing an ANQP message.
CVE-2025-21439, published 2025-04-07. High severity, CVSS 7.8. EPSS: 0.1% chance of exploitation in the next 30 days. Memory corruption may occur while reading board data via IOCTL call when the WLAN driver copies the content to the provided output buffer.
CVE-2025-21438, published 2025-04-07. High severity, CVSS 7.8. EPSS: 0.1% chance of exploitation in the next 30 days. Memory corruption while IOCTL call is invoked from user-space to read board data.
CVE-2024-45542, published 2025-01-06. High severity, CVSS 7.8. EPSS: 0.1% chance of exploitation in the next 30 days. Memory corruption when IOCTL call is invoked from user-space to write board data to WLAN driver.
CVE-2024-45541, published 2025-01-06. High severity, CVSS 7.8. EPSS: 0.1% chance of exploitation in the next 30 days. Memory corruption when IOCTL call is invoked from user-space to read board data.
CVE-2024-43050, published 2024-12-02. High severity, CVSS 7.8. EPSS: 0.1% chance of exploitation in the next 30 days. Memory corruption while invoking IOCTL calls from user space to issue factory test command inside WLAN driver.
CVE-2024-38408, published 2024-11-04. Critical severity, CVSS 9.1. EPSS: 0.1% chance of exploitation in the next 30 days. Cryptographic issue when a controller receives an LMP start encryption command under unexpected conditions.