Skip to main content

Sd 210 Firmware CVE-2018-11846

MEDIUM
Information Exposure (CWE-200)
2018-10-26 product-security@qualcomm.com
4.7
CVSS 3.0 · NVD
View

Vulnerability Assessment

Weakness
CWE
OWASP Top 10:2025
A01:2025 - Broken Access Control
ASVS 5.0
V14 - Data Protection Data exposure prevention
MITRE ATT&CK

2 techniques across 2 tactics: Collection, Discovery

The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up.

Impact

CVSS score of 4.7 (MEDIUM). Attack characteristics: local attack vector, high complexity, low privileges required, no user interaction not required.

Exploit ScenarioDerived

A local attacker with access to the system could access sensitive data that should not be disclosed.

This Month Plan within 30 days. Why: MEDIUM severity (CVSS 4.0-6.9).
No patch listed yet 0.2% exploitation probability (EPSS)

Get an e-mail when this CVE is exploited, patched or re-scored. Free account.

Alert me

AnalysisAI

The use of a non-time-constant memory comparison operation can lead to timing/side channel attacks in Snapdragon Mobile in version SD 210/SD 212/SD 205, SD 845, SD 850. Rated medium severity (CVSS 4.7). No vendor patch available.

RemediationAI

No vendor patch is available at time of analysis. Monitor vendor advisories for updates. Minimize information in error messages, implement proper access controls, encrypt sensitive data at rest and in transit.

Affects your stack

Find out whether the stacks and servers you run are on an affected version.

Checking this CVE against your own stacks and servers is part of the Basic plan and up.

Technical ContextAI · show details

This vulnerability is classified as Exposure of Sensitive Information (CWE-200), which allows attackers to access sensitive data that should not be disclosed. The use of a non-time-constant memory comparison operation can lead to timing/side channel attacks in Snapdragon Mobile in version SD 210/SD 212/SD 205, SD 845, SD 850 Affected products include: Qualcomm Sd 210 Firmware, Qualcomm Sd 212 Firmware, Qualcomm Sd 205 Firmware, Qualcomm Sd 845 Firmware, Qualcomm Sd 850 Firmware.

Know when Sd 210 Firmware gets its next vulnerability

  • Watch products and get an email when something new is published
  • Check this CVE against your own stack and servers
  • Exploit and PoC references, threat intelligence from 22 sources

No credit card · 7-day full trial

Severity by source

NVD PRIMARY 4.7 MEDIUM
AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:N/A:N

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

Attack Vector
Local
Attack Complexity
High
Privileges Required
Low
User Interaction
None
Scope
Unchanged
Confidentiality
High
Integrity
None
Availability
None

DescriptionNVD

The use of a non-time-constant memory comparison operation can lead to timing/side channel attacks in Snapdragon Mobile in version SD 210/SD 212/SD 205, SD 845, SD 850

Threat Intelligence Overview

EPSS Score
0.2%
Top 94% exploitable
Data Quality
2 sources
Confidence: Low

How this decision was reached

The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.

SignalValue
Severity MEDIUM
CISA KEV No
Public POC No
EPSS 0.2%
Patch available No
Active threat No
Deciding rule
MEDIUM severity (CVSS 4.0-6.9)
What every action level means
Emergency Immediate action required. Criteria: CRITICAL + in CISA KEV (actively exploited) without patch, OR CRITICAL + EPSS > 30% without patch, OR CRITICAL + active threat signals without patch.
Act Now Prioritize within 24-48h. Criteria: in KEV with patch available, OR CRITICAL + public POC, OR HIGH + EPSS > 10%, OR CRITICAL + active threat, OR any CRITICAL severity.
This Week Schedule remediation this week. Criteria: HIGH severity (CVSS 7.0-8.9). Patch within normal change window.
This Month Plan within 30 days. Criteria: MEDIUM severity (CVSS 4.0-6.9), lower exploitation probability. Include in regular patch cycle.
Monitor Track and reassess. Criteria: LOW severity (CVSS 0.1-3.9), minimal exploitation risk. No immediate action needed.

SSVC AssessmentENISA

SSVC Decision· derived
Defer
Exploitation· derived
None
System Exposure· derived
Small
Automatable· derived
No
Human Impact· derived
Medium

Priority Score

24
Low Medium High Critical
KEV: 0
EPSS: 0
CVSS: +24
PoC: 0
Weaponized: 0
Threat intel: 0
Gov advisory: 0

Attack Technique

Information disclosure occurs when an application unintentionally exposes sensitive data that aids attackers in reconnaissance or directly compromises security.

Affected Products (CPE)NVD

cpe:2.3:o:qualcomm:sd_210_firmware:-:*:*:*:*:*:*:*
cpe:2.3:o:qualcomm:sd_212_firmware:-:*:*:*:*:*:*:*
cpe:2.3:o:qualcomm:sd_205_firmware:-:*:*:*:*:*:*:*
cpe:2.3:o:qualcomm:sd_845_firmware:-:*:*:*:*:*:*:*
cpe:2.3:o:qualcomm:sd_850_firmware:-:*:*:*:*:*:*:*
CVE-2019-2332 CRITICAL
9.8 Nov 06

Memory corruption while accessing the memory as payload size is not validated before access in Snapdragon Auto, Snapdrag

CVE-2019-2331 CRITICAL
9.8 Nov 06

Possible Integer overflow because of subtracting two integers without checking if the result would overflow or not in Sn

CVE-2019-2325 CRITICAL
9.8 Nov 06

Out of boundary access due to token received from ADSP and is used without validation as an index into the array in Snap

CVE-2019-2324 CRITICAL
9.8 Nov 06

When ADSP is compromised, the audio port index that`s returned from ADSP might be out of the valid range and leads to ou

CVE-2019-2323 CRITICAL
9.8 Nov 06

Lack of check to ensure crypto engine data passed by user is initialized can result in bus error in Snapdragon Auto, Sna

CVE-2019-2285 CRITICAL
9.8 Nov 06

Out of bound write issue is observed while giving information about properties that have been set so far for playing vid

CVE-2019-2283 CRITICAL
9.8 Nov 06

Improper validation of read and write index of tx and rx fifo`s before calculating pointer can lead to out-of-bound acce

CVE-2019-2258 CRITICAL
9.8 Nov 06

Improper validation of array index causes OOB write and then leads to memory corruption in MMCP in Snapdragon Auto, Snap

CVE-2019-10542 CRITICAL
9.8 Nov 06

Buffer over-read may occur when downloading a corrupted firmware file that has chunk length in header which doesn`t matc

CVE-2019-10541 CRITICAL
9.8 Nov 06

Dereference on uninitialized buffer can happen when parsing FLV clip with corrupted codec specific data in Snapdragon Au

CVE-2019-10534 CRITICAL
9.8 Nov 06

Null-pointer dereference can occur while accessing the super index entry when it is not been allocated in Snapdragon Aut

CVE-2019-10533 CRITICAL
9.8 Nov 06

Out of bound access due to improper validation of array index cause the index table entry to get corrupt in Snapdragon A

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy