Qualcomm SD625 Firmware vulnerabilities

36 CVEs affecting Qualcomm SD625 Firmware, 0 known to be exploited (CISA KEV), with EPSS scores. Latest: CVE-2023-28537, published 2023-08-08.

More from Qualcomm.

Highest priority

Known exploited (CISA KEV) first, then by EPSS exploit probability.

• CVE-2018-11287, published 2018-09-20. Critical severity, CVSS 9.8. EPSS: 0.9% chance of exploitation in the next 30 days. In Snapdragon (Automobile, Mobile, Wear) in version MDM9206, MDM9607, MDM9650, MSM8909W, MSM8996AU, SD 210/SD 212/SD 205, SD 425, SD 427, SD 430, SD 435, SD 450, SD 625, SD 650/52, SD 820, SD 820A,…
• CVE-2017-18314, published 2018-09-20. Critical severity, CVSS 9.8. EPSS: 0.9% chance of exploitation in the next 30 days. In Snapdragon (Automobile, Mobile, Wear) in version MDM9206, MDM9607, MDM9635M, MDM9640, MDM9645, MDM9650, MDM9655, MSM8909W, MSM8996AU, SD 210/SD 212/SD 205, SD 410/12, SD 425, SD 427, SD 430, SD…
• CVE-2018-11290, published 2018-09-20. High severity, CVSS 7.5. EPSS: 0.8% chance of exploitation in the next 30 days. In Snapdragon (Automobile, Mobile, Wear) in version MDM9206, MDM9607, MDM9640, MDM9650, MSM8996AU, QCA6574AU, QCA6584, SD 210/SD 212/SD 205, SD 425, SD 427, SD 430, SD 435, SD 450, SD 625, SD 650/52,…
• CVE-2018-11291, published 2018-09-20. High severity, CVSS 7.5. EPSS: 0.8% chance of exploitation in the next 30 days. In Snapdragon (Automobile, Mobile, Wear) in version IPQ8074, MDM9206, MDM9607, MDM9640, MDM9650, MSM8996AU, QCA4531, QCA6174A, QCA6564, QCA6574, QCA6574AU, QCA6584, QCA6584AU, QCA9377, QCA9378,…
• CVE-2018-5837, published 2018-09-20. High severity, CVSS 7.5. EPSS: 0.6% chance of exploitation in the next 30 days. In Snapdragon (Automobile, Mobile, Wear) in version IPQ8074, MDM9206, MDM9607, MDM9640, MDM9650, MSM8996AU, QCA6574AU, SD 210/SD 212/SD 205, SD 425, SD 427, SD 430, SD 435, SD 450, SD 625, SD 820A,…
• CVE-2018-11285, published 2018-09-20. High severity, CVSS 7.8. EPSS: 0.6% chance of exploitation in the next 30 days. In Snapdragon (Automobile, Mobile, Wear) in version MDM9206, MDM9607, MDM9650, MSM8909W, MSM8996AU, SD 210/SD 212/SD 205, SD 425, SD 427, SD 430, SD 435, SD 450, SD 615/16/SD 415, SD 625, SD 650/52,…
• CVE-2022-22088, published 2023-01-09. High severity, CVSS 8.8. EPSS: 0.5% chance of exploitation in the next 30 days. Memory corruption in Bluetooth HOST due to buffer overflow while parsing the command response received from remote
• CVE-2022-40510, published 2023-08-08. Critical severity, CVSS 9.8. EPSS: 0.4% chance of exploitation in the next 30 days. Memory corruption due to buffer copy without checking size of input in Audio while voice call with EVS vocoder.
• CVE-2022-33255, published 2023-01-09. Medium severity, CVSS 6.5. EPSS: 0.4% chance of exploitation in the next 30 days. Information disclosure due to buffer over-read in Bluetooth HOST while processing GetFolderItems and GetItemAttribute Cmds from peer device.
• CVE-2022-33213, published 2023-03-10. High severity, CVSS 8.8. EPSS: 0.4% chance of exploitation in the next 30 days. Memory corruption in modem due to buffer overflow while processing a PPP packet

Latest

• CVE-2023-28537, published 2023-08-08. High severity, CVSS 7.8. EPSS: 0.1% chance of exploitation in the next 30 days. Memory corruption while allocating memory in COmxApeDec module in Audio.
• CVE-2023-22666, published 2023-08-08. High severity, CVSS 7.8. EPSS: 0.1% chance of exploitation in the next 30 days. Memory Corruption in Audio while playing amrwbplus clips with modified content.
• CVE-2023-21626, published 2023-08-08. High severity, CVSS 7.1. EPSS: 0.1% chance of exploitation in the next 30 days. Cryptographic issue in HLOS due to improper authentication while performing key velocity checks using more than one key.
• CVE-2022-40537, published 2023-03-10. Critical severity, CVSS 9.8. EPSS: 0.4% chance of exploitation in the next 30 days. Memory corruption in Bluetooth HOST while processing the AVRC_PDU_GET_PLAYER_APP_VALUE_TEXT AVRCP response.
• CVE-2022-40515, published 2023-03-10. Critical severity, CVSS 9.8. EPSS: 0.3% chance of exploitation in the next 30 days. Memory corruption in Video due to double free while playing 3gp clip with invalid metadata atoms.
• CVE-2022-25705, published 2023-03-10. High severity, CVSS 7.8. EPSS: 0.1% chance of exploitation in the next 30 days. Memory corruption in modem due to integer overflow to buffer overflow while handling APDU response
• CVE-2022-25694, published 2023-03-10. High severity, CVSS 7.8. EPSS: 0.1% chance of exploitation in the next 30 days. Memory corruption in Modem due to usage of Out-of-range pointer offset in UIM
• CVE-2022-22075, published 2023-03-10. Medium severity, CVSS 5.5. EPSS: 0.1% chance of exploitation in the next 30 days. Information Disclosure in Graphics during GPU context switch.