Qualcomm Snapdragon SC8180X-Ac Firmware vulnerabilities

9 CVEs affecting Qualcomm Snapdragon SC8180X-Ac Firmware, 0 known to be exploited (CISA KEV), with EPSS scores. Latest: CVE-2023-33098, published 2023-12-05.

More from Qualcomm.

Highest priority

Known exploited (CISA KEV) first, then by EPSS exploit probability.

• CVE-2023-33098, published 2023-12-05. High severity, CVSS 7.5. EPSS: 0.5% chance of exploitation in the next 30 days. Transient DOS while parsing WPA IES, when it is passed with length more than expected size.
• CVE-2023-33089, published 2023-12-05. High severity, CVSS 7.5. EPSS: 0.5% chance of exploitation in the next 30 days. Transient DOS when processing a NULL buffer while parsing WLAN vdev.
• CVE-2023-33088, published 2023-12-05. High severity, CVSS 7.8. EPSS: 0.2% chance of exploitation in the next 30 days. Memory corruption when processing cmd parameters while parsing vdev.
• CVE-2023-28587, published 2023-12-05. High severity, CVSS 7.8. EPSS: 0.2% chance of exploitation in the next 30 days. Memory corruption in BT controller while parsing debug commands with specific sub-opcodes at HCI interface level.
• CVE-2023-28585, published 2023-12-05. High severity, CVSS 8.8. EPSS: 0.1% chance of exploitation in the next 30 days. Memory corruption while loading an ELF segment in TEE Kernel.
• CVE-2023-28586, published 2023-12-05. Medium severity, CVSS 6.5. EPSS: 0.1% chance of exploitation in the next 30 days. Information disclosure when the trusted application metadata symbol addresses are accessed while loading an ELF in TEE.
• CVE-2023-28551, published 2023-12-05. High severity, CVSS 7.8. EPSS: 0.1% chance of exploitation in the next 30 days. Memory corruption in UTILS when modem processes memory specific Diag commands having arbitrary address values as input arguments.
• CVE-2023-28550, published 2023-12-05. High severity, CVSS 7.8. EPSS: 0.1% chance of exploitation in the next 30 days. Memory corruption in MPP performance while accessing DSM watermark using external memory address.
• CVE-2023-28546, published 2023-12-05. High severity, CVSS 7.8. EPSS: 0.1% chance of exploitation in the next 30 days. Memory Corruption in SPS Application while exporting public key in sorter TA.