Qualcomm SDX70M Firmware vulnerabilities

17 CVEs affecting Qualcomm SDX70M Firmware, 0 known to be exploited (CISA KEV), with EPSS scores. Latest: CVE-2023-21664, published 2023-09-05.

More from Qualcomm.

Highest priority

Known exploited (CISA KEV) first, then by EPSS exploit probability.

• CVE-2022-33256, published 2023-03-10. Critical severity, CVSS 9.8. EPSS: 0.5% chance of exploitation in the next 30 days. Memory corruption due to improper validation of array index in Multi-mode call processor.
• CVE-2022-33213, published 2023-03-10. High severity, CVSS 8.8. EPSS: 0.4% chance of exploitation in the next 30 days. Memory corruption in modem due to buffer overflow while processing a PPP packet
• CVE-2022-33272, published 2023-03-10. High severity, CVSS 7.5. EPSS: 0.4% chance of exploitation in the next 30 days. Transient DOS in modem due to reachable assertion.
• CVE-2022-33254, published 2023-03-10. High severity, CVSS 7.5. EPSS: 0.4% chance of exploitation in the next 30 days. Transient DOS due to reachable assertion in Modem while processing SIB1 Message.
• CVE-2022-33250, published 2023-03-10. High severity, CVSS 7.5. EPSS: 0.4% chance of exploitation in the next 30 days. Transient DOS due to reachable assertion in modem when network repeatedly sent invalid message container for NR to LTE handover.
• CVE-2022-33244, published 2023-03-10. High severity, CVSS 7.5. EPSS: 0.4% chance of exploitation in the next 30 days. Transient DOS due to reachable assertion in modem during MIB reception and SIB timeout
• CVE-2023-21653, published 2023-09-05. High severity, CVSS 7.5. EPSS: 0.4% chance of exploitation in the next 30 days. Transient DOS in Modem while processing RRC reconfiguration message.
• CVE-2023-21646, published 2023-09-05. High severity, CVSS 7.5. EPSS: 0.4% chance of exploitation in the next 30 days. Transient DOS in Modem while processing invalid System Information Block 1.
• CVE-2022-25705, published 2023-03-10. High severity, CVSS 7.8. EPSS: 0.1% chance of exploitation in the next 30 days. Memory corruption in modem due to integer overflow to buffer overflow while handling APDU response
• CVE-2022-33248, published 2023-02-12. High severity, CVSS 7.8. EPSS: 0.1% chance of exploitation in the next 30 days. Memory corruption in User Identity Module due to integer overflow to buffer overflow when a segement is received via qmi http.

Latest

• CVE-2023-21664, published 2023-09-05. High severity, CVSS 7.8. EPSS: 0.1% chance of exploitation in the next 30 days. Memory Corruption in Core Platform while printing the response buffer in log.
• CVE-2023-21662, published 2023-09-05. High severity, CVSS 7.8. EPSS: 0.1% chance of exploitation in the next 30 days. Memory corruption in Core Platform while printing the response buffer in log.
• CVE-2022-33257, published 2023-03-10. High severity, CVSS 7.0. EPSS: 0.1% chance of exploitation in the next 30 days. Memory corruption in Core due to time-of-check time-of-use race condition during dump collection in trust zone.