Qualcomm SM8450P Firmware vulnerabilities

23 CVEs affecting Qualcomm SM8450P Firmware, 0 known to be exploited (CISA KEV), with EPSS scores. Latest: CVE-2021-30351, published 2022-01-03.

Highest priority

Known exploited (CISA KEV) first, then by EPSS exploit probability.

CVE-2021-30351, published 2022-01-03. Critical severity, CVSS 9.8. EPSS: 4% chance of exploitation in the next 30 days. An out of bound memory access can occur due to improper validation of number of frames being passed during music playback in Snapdragon Auto, Snapdragon Compute, Snapdragon Connectivity, Snapdragon…
CVE-2021-1975, published 2021-11-12. Critical severity, CVSS 9.8. EPSS: 0.9% chance of exploitation in the next 30 days. Possible heap overflow due to improper length check of domain while parsing the DNS response in Snapdragon Auto, Snapdragon Compute, Snapdragon Connectivity, Snapdragon Consumer IOT, Snapdragon…
CVE-2021-1981, published 2021-11-12. Critical severity, CVSS 9.1. EPSS: 0.6% chance of exploitation in the next 30 days. Possible buffer over read due to improper IE size check of Bearer capability IE in MT setup request from network in Snapdragon Auto, Snapdragon Compute, Snapdragon Connectivity, Snapdragon Consumer…
CVE-2021-1982, published 2021-11-12. High severity, CVSS 7.5. EPSS: 0.6% chance of exploitation in the next 30 days. Possible denial of service scenario due to improper input validation of received NAS OTA message in Snapdragon Auto, Snapdragon Compute, Snapdragon Connectivity, Snapdragon Consumer IOT, Snapdragon…
CVE-2021-30293, published 2022-01-03. High severity, CVSS 7.5. EPSS: 0.6% chance of exploitation in the next 30 days. Possible assertion due to lack of input validation in PUSCH configuration in Snapdragon Auto, Snapdragon Compute, Snapdragon Connectivity, Snapdragon Consumer IOT, Snapdragon Industrial IOT
CVE-2021-1903, published 2021-11-12. Medium severity, CVSS 5.3. EPSS: 0.5% chance of exploitation in the next 30 days. Possible denial of service scenario can occur due to lack of length check on Channel Switch Announcement IE in beacon or probe response frame in Snapdragon Auto, Snapdragon Compute, Snapdragon…
CVE-2021-30348, published 2022-01-03. Medium severity, CVSS 6.5. EPSS: 0.2% chance of exploitation in the next 30 days. Improper validation of LLM utility timers availability can lead to denial of service in Snapdragon Auto, Snapdragon Compute, Snapdragon Connectivity, Snapdragon Consumer Electronics Connectivity,…
CVE-2021-30266, published 2021-11-12. Medium severity, CVSS 6.7. EPSS: 0.2% chance of exploitation in the next 30 days. Possible use after free due to improper memory validation when initializing new interface via Interface add command in Snapdragon Auto, Snapdragon Compute, Snapdragon Connectivity, Snapdragon…
CVE-2021-30303, published 2022-01-03. High severity, CVSS 7.8. EPSS: 0.2% chance of exploitation in the next 30 days. Possible buffer overflow due to lack of buffer length check when segmented WMI command is received in Snapdragon Auto, Snapdragon Compute, Snapdragon Connectivity, Snapdragon Consumer Electronics…
CVE-2021-30255, published 2021-11-12. High severity, CVSS 7.8. EPSS: 0.2% chance of exploitation in the next 30 days. Possible buffer overflow due to improper input validation in PDM DIAG command in FTM in Snapdragon Auto, Snapdragon Compute, Snapdragon Connectivity, Snapdragon Consumer IOT, Snapdragon Industrial…

Latest

CVE-2021-30337, published 2022-01-03. High severity, CVSS 7.8. EPSS: 0.2% chance of exploitation in the next 30 days. Possible use after free when process shell memory is freed using IOCTL call and process initialization is in progress in Snapdragon Auto, Snapdragon Compute, Snapdragon Connectivity, Snapdragon…
CVE-2021-30336, published 2022-01-03. High severity, CVSS 7.8. EPSS: 0.2% chance of exploitation in the next 30 days. Possible out of bound read due to lack of domain input validation while processing APK close session request in Snapdragon Auto, Snapdragon Compute, Snapdragon Connectivity, Snapdragon Industrial…
CVE-2021-30272, published 2022-01-03. High severity, CVSS 7.8. EPSS: 0.2% chance of exploitation in the next 30 days. Possible null pointer dereference in thread cache operation handler due to lack of validation of user provided input in Snapdragon Auto, Snapdragon Compute, Snapdragon Connectivity, Snapdragon…
CVE-2021-30271, published 2022-01-03. High severity, CVSS 7.8. EPSS: 0.2% chance of exploitation in the next 30 days. Possible null pointer dereference in trap handler due to lack of thread ID validation before dereferencing it in Snapdragon Auto, Snapdragon Compute, Snapdragon Connectivity, Snapdragon Consumer…
CVE-2021-30269, published 2022-01-03. High severity, CVSS 7.8. EPSS: 0.2% chance of exploitation in the next 30 days. Possible null pointer dereference due to lack of TLB validation for user provided address in Snapdragon Auto, Snapdragon Compute, Snapdragon Connectivity, Snapdragon Consumer Electronics…
CVE-2021-30268, published 2022-01-03. High severity, CVSS 7.8. EPSS: 0.2% chance of exploitation in the next 30 days. Possible heap Memory Corruption Issue due to lack of input validation when sending HWTC IQ Capture command in Snapdragon Auto, Snapdragon Compute, Snapdragon Connectivity, Snapdragon Consumer IOT,…