Qualcomm Snapdragon Wear 2100 Platform Firmware vulnerabilities

26 CVEs affecting Qualcomm Snapdragon Wear 2100 Platform Firmware, 1 known to be exploited (CISA KEV), with EPSS scores. Latest: CVE-2024-45552, published 2025-04-07.

More from Qualcomm.

Highest priority

Known exploited (CISA KEV) first, then by EPSS exploit probability.

• CVE-2023-33107: Qualcomm Multiple Chipsets Integer Overflow Vulnerability, published 2023-12-05. High severity, CVSS 7.8. Actively exploited: in CISA KEV since 2023-12-05. EPSS: 0.7% chance of exploitation in the next 30 days. Memory corruption in Graphics Linux while assigning shared virtual memory region during IOCTL call.
• CVE-2023-22385, published 2023-10-03. Critical severity, CVSS 9.8. EPSS: 0.4% chance of exploitation in the next 30 days. Memory Corruption in Data Modem while making a MO call or MT VOLTE call.
• CVE-2022-40503, published 2023-04-13. High severity, CVSS 7.5. EPSS: 0.4% chance of exploitation in the next 30 days. Information disclosure due to buffer over-read in Bluetooth Host while A2DP streaming.
• CVE-2023-24849, published 2023-10-03. High severity, CVSS 7.5. EPSS: 0.4% chance of exploitation in the next 30 days. Information Disclosure in data Modem while parsing an FMTP line in an SDP message.
• CVE-2023-24848, published 2023-10-03. High severity, CVSS 7.5. EPSS: 0.4% chance of exploitation in the next 30 days. Information Disclosure in Data Modem while performing a VoLTE call with an undefined RTCP FB line value.
• CVE-2022-40521, published 2023-06-06. High severity, CVSS 7.5. EPSS: 0.4% chance of exploitation in the next 30 days. Transient DOS due to improper authorization in Modem
• CVE-2023-22388, published 2023-11-07. Critical severity, CVSS 9.8. EPSS: 0.4% chance of exploitation in the next 30 days. Memory Corruption in Multi-mode Call Processor while processing bit mask API.
• CVE-2024-23353, published 2024-08-05. High severity, CVSS 7.5. EPSS: 0.3% chance of exploitation in the next 30 days. Transient DOS while decoding attach reject message received by UE, when IEI is set to ESM_IEI.
• CVE-2024-45552, published 2025-04-07. High severity, CVSS 8.2. EPSS: 0.3% chance of exploitation in the next 30 days. Information disclosure may occur during a video call if a device resets due to a non-conforming RTCP packet that doesn`t adhere to RFC standards.
• CVE-2022-33289, published 2023-04-13. Medium severity, CVSS 6.8. EPSS: 0.2% chance of exploitation in the next 30 days. Memory corruption occurs in Modem due to improper validation of array index when malformed APDU is sent from card.

Latest

• CVE-2024-43052, published 2024-12-02. High severity, CVSS 7.8. EPSS: 0.1% chance of exploitation in the next 30 days. Memory corruption while processing API calls to NPU with invalid input.
• CVE-2024-38423, published 2024-11-04. High severity, CVSS 7.8. EPSS: 0.1% chance of exploitation in the next 30 days. Memory corruption while processing GPU page table switch.
• CVE-2024-38422, published 2024-11-04. High severity, CVSS 7.8. EPSS: 0.1% chance of exploitation in the next 30 days. Memory corruption while processing voice packet with arbitrary data received from ADSP.
• CVE-2024-33043, published 2024-09-02. Medium severity, CVSS 5.5. EPSS: 0.1% chance of exploitation in the next 30 days. Transient DOS while handling PS event when Program Service name length offset value is set to 255.
• CVE-2023-33120, published 2024-01-02. High severity, CVSS 7.8. EPSS: 0.1% chance of exploitation in the next 30 days. Memory corruption in Audio when memory map command is executed consecutively in ADSP.
• CVE-2023-33110, published 2024-01-02. High severity, CVSS 7.0. EPSS: 0.1% chance of exploitation in the next 30 days. The session index variable in PCM host voice audio driver initialized before PCM open, accessed during event callback from ADSP and reset during PCM close may lead to race condition between event…
• CVE-2023-33033, published 2024-01-02. High severity, CVSS 7.8. EPSS: 0.1% chance of exploitation in the next 30 days. Memory corruption in Audio during playback with speaker protection.
• CVE-2023-33030, published 2024-01-02. High severity, CVSS 7.8. EPSS: 0.1% chance of exploitation in the next 30 days. Memory corruption in HLOS while running playready use-case.