Qualcomm QCS615 Firmware vulnerabilities

49 CVEs affecting Qualcomm QCS615 Firmware, 0 known to be exploited (CISA KEV), with EPSS scores. Latest: CVE-2025-47366, published 2026-02-02.

More from Qualcomm.

Highest priority

Known exploited (CISA KEV) first, then by EPSS exploit probability.

• CVE-2024-45569, published 2025-02-03. Critical severity, CVSS 9.8. EPSS: 0.6% chance of exploitation in the next 30 days. Memory corruption while parsing the ML IE due to invalid frame content.
• CVE-2025-21483, published 2025-09-24. Critical severity, CVSS 9.8. EPSS: 0.4% chance of exploitation in the next 30 days. Memory corruption when the UE receives an RTP packet from the network, during the reassembly of NALUs.
• CVE-2025-21459, published 2025-05-06. High severity, CVSS 7.5. EPSS: 0.3% chance of exploitation in the next 30 days. Transient DOS while parsing per STA profile in ML IE.
• CVE-2024-49838, published 2025-02-03. High severity, CVSS 7.5. EPSS: 0.3% chance of exploitation in the next 30 days. Information disclosure while parsing the OCI IE with invalid length.
• CVE-2024-53026, published 2025-06-03. High severity, CVSS 8.2. EPSS: 0.3% chance of exploitation in the next 30 days. Information disclosure when an invalid RTCP packet is received during a VoLTE/VoWiFi IMS call.
• CVE-2024-53027, published 2025-03-03. High severity, CVSS 7.5. EPSS: 0.3% chance of exploitation in the next 30 days. Transient DOS may occur while processing the country IE.
• CVE-2024-49839, published 2025-02-03. Critical severity, CVSS 9.8. EPSS: 0.3% chance of exploitation in the next 30 days. Memory corruption during management frame processing due to mismatch in T2LM info element.
• CVE-2025-27066, published 2025-08-06. High severity, CVSS 7.5. EPSS: 0.3% chance of exploitation in the next 30 days. Transient DOS while processing an ANQP message.
• CVE-2025-21434, published 2025-04-07. High severity, CVSS 7.5. EPSS: 0.3% chance of exploitation in the next 30 days. Transient DOS may occur while parsing EHT operation IE or EHT capability IE.
• CVE-2025-21430, published 2025-04-07. High severity, CVSS 7.5. EPSS: 0.3% chance of exploitation in the next 30 days. Transient DOS while connecting STA to AP and initiating ADD TS request from AP to establish TSpec session.

Latest

• CVE-2025-47366, published 2026-02-02. High severity, CVSS 7.8. EPSS: 0.1% chance of exploitation in the next 30 days. Cryptographic issue when a Trusted Zone with outdated code is triggered by a HLOS providing incorrect input.
• CVE-2025-47369, published 2026-01-07. Medium severity, CVSS 5.5. EPSS: 0.1% chance of exploitation in the next 30 days. Information disclosure when a weak hashed value is returned to userland code in response to a IOCTL call to obtain a session ID.
• CVE-2025-47348, published 2026-01-07. High severity, CVSS 7.8. EPSS: 0.1% chance of exploitation in the next 30 days. Memory corruption while processing identity credential operations in the trusted application.
• CVE-2025-47346, published 2026-01-07. High severity, CVSS 7.8. EPSS: 0.1% chance of exploitation in the next 30 days. Memory corruption while processing a secure logging command in the trusted application.
• CVE-2025-47345, published 2026-01-07. High severity, CVSS 8.4. EPSS: 0.1% chance of exploitation in the next 30 days. Cryptographic issue may occur while encrypting license data.
• CVE-2025-47344, published 2026-01-07. Medium severity, CVSS 6.4. EPSS: 0.1% chance of exploitation in the next 30 days. Memory corruption while handling sensor utility operations.
• CVE-2025-47339, published 2026-01-07. High severity, CVSS 7.8. EPSS: 0.1% chance of exploitation in the next 30 days. Memory corruption while deinitializing a HDCP session.
• CVE-2025-47337, published 2026-01-07. Medium severity, CVSS 6.7. EPSS: 0.1% chance of exploitation in the next 30 days. Memory corruption while accessing a synchronization object during concurrent operations.
• CVE-2025-47335, published 2026-01-07. Medium severity, CVSS 6.7. EPSS: 0.1% chance of exploitation in the next 30 days. Memory corruption while parsing clock configuration data for a specific hardware type.
• CVE-2025-47334, published 2026-01-07. Medium severity, CVSS 6.7. EPSS: 0.1% chance of exploitation in the next 30 days. Memory corruption while processing shared command buffer packet between camera userspace and kernel.