Qualcomm Snapdragon 820 Automotive Firmware vulnerabilities

21 CVEs affecting Qualcomm Snapdragon 820 Automotive Firmware, 0 known to be exploited (CISA KEV), with EPSS scores. Latest: CVE-2025-21454, published 2025-07-08.

More from Qualcomm.

Highest priority

Known exploited (CISA KEV) first, then by EPSS exploit probability.

• CVE-2024-33051, published 2024-09-02. High severity, CVSS 7.5. EPSS: 0.3% chance of exploitation in the next 30 days. Transient DOS while processing TIM IE from beacon frame as there is no check for IE length.
• CVE-2024-53027, published 2025-03-03. High severity, CVSS 7.5. EPSS: 0.3% chance of exploitation in the next 30 days. Transient DOS may occur while processing the country IE.
• CVE-2023-43551, published 2024-06-03. High severity, CVSS 7.5. EPSS: 0.3% chance of exploitation in the next 30 days. Cryptographic issue while performing attach with a LTE network, a rogue base station can skip the authentication phase and immediately send the Security Mode Command.
• CVE-2025-21427, published 2025-07-08. High severity, CVSS 8.2. EPSS: 0.2% chance of exploitation in the next 30 days. Information disclosure while decoding this RTP packet Payload when UE receives the RTP packet from the network.
• CVE-2025-21454, published 2025-07-08. High severity, CVSS 7.5. EPSS: 0.2% chance of exploitation in the next 30 days. Transient DOS while processing received beacon frame.
• CVE-2025-21449, published 2025-07-08. High severity, CVSS 7.5. EPSS: 0.2% chance of exploitation in the next 30 days. Transient DOS may occur while processing malformed length field in SSID IEs.
• CVE-2023-43555, published 2024-06-03. High severity, CVSS 7.5. EPSS: 0.2% chance of exploitation in the next 30 days. Information disclosure in Video while parsing mp2 clip with invalid section length.
• CVE-2024-33060, published 2024-09-02. High severity, CVSS 7.8. EPSS: 0.2% chance of exploitation in the next 30 days. Memory corruption when two threads try to map and unmap a single node simultaneously.
• CVE-2024-45555, published 2025-01-06. High severity, CVSS 7.8. EPSS: 0.1% chance of exploitation in the next 30 days. Memory corruption can occur if an already verified IFS2 image is overwritten, bypassing boot verification. This allows unauthorized programs to be injected into security-sensitive images, enabling…
• CVE-2024-33052, published 2024-09-02. High severity, CVSS 7.8. EPSS: 0.1% chance of exploitation in the next 30 days. Memory corruption when user provides data for FM HCI command control operations.

Latest

• CVE-2024-45562, published 2025-05-06. High severity, CVSS 7.8. EPSS: 0.1% chance of exploitation in the next 30 days. Memory corruption during concurrent access to server info object due to unprotected critical field.
• CVE-2024-53030, published 2025-03-03. High severity, CVSS 7.8. EPSS: 0.1% chance of exploitation in the next 30 days. Memory corruption while processing input message passed from FE driver.
• CVE-2024-38416, published 2025-02-03. Medium severity, CVSS 5.5. EPSS: 0.1% chance of exploitation in the next 30 days. Information disclosure during audio playback.
• CVE-2024-33067, published 2025-01-06. Medium severity, CVSS 5.5. EPSS: 0.1% chance of exploitation in the next 30 days. Information disclosure while invoking callback function of sound model driver from ADSP for every valid opcode received from sound model driver.