Skip to main content

Mdm9150 Firmware CVE-2019-2258

CRITICAL
Improper Validation of Array Index (CWE-129)
2019-11-06 product-security@qualcomm.com
Buffer Overflow Qualcomm Mdm9150 Firmware Mdm9607 Firmware Mdm9615 Firmware Mdm9625 Firmware Mdm9635M Firmware Mdm9640 Firmware Mdm9650 Firmware Mdm9655 Firmware Msm8909W Firmware Msm8996au Firmware Qcs605 Firmware Qualcomm 215 Firmware Sd 210 Firmware Sd 212 Firmware Sd 205 Firmware Sd 425 Firmware Sd 427 Firmware Sd 430 Firmware Sd 435 Firmware Sd 439 Firmware Sd 429 Firmware Sd 450 Firmware Sd 615 Firmware Sd 616 Firmware Sd 415 Firmware Sd 625 Firmware Sd 632 Firmware Sd 636 Firmware Sd 650 Firmware Sd 652 Firmware Sd 665 Firmware Sd 675 Firmware Sd 712 Firmware Sd 710 Firmware Sd 670 Firmware Sd 730 Firmware Sd 820 Firmware Sd 820A Firmware Sd 835 Firmware Sd 845 Firmware Sd 850 Firmware Sd 855 Firmware Sd 8cx Firmware Sda660 Firmware Sdm439 Firmware Sdm630 Firmware Sdm660 Firmware Sdx20 Firmware Snapdragon High Med 2016 Firmware Sxr1130 Firmware
9.8
CVSS 3.1 · NVD
Share

Severity by source

NVD PRIMARY
9.8 CRITICAL
AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Attack Vector
Network
Attack Complexity
Low
Privileges Required
None
User Interaction
None
Scope
Unchanged
Confidentiality
High
Integrity
High
Availability
High

Lifecycle Timeline

1
CVE Published
Nov 06, 2019 - 17:15 nvd
CRITICAL 9.8

DescriptionNVD

Improper validation of array index causes OOB write and then leads to memory corruption in MMCP in Snapdragon Auto, Snapdragon Compute, Snapdragon Consumer IOT, Snapdragon Industrial IOT, Snapdragon IoT, Snapdragon Mobile, Snapdragon Voice & Music, Snapdragon Wearables in MDM9150, MDM9607, MDM9615, MDM9625, MDM9635M, MDM9640, MDM9650, MDM9655, MSM8909W, MSM8996AU, QCS605, Qualcomm 215, SD 210/SD 212/SD 205, SD 425, SD 427, SD 430, SD 435, SD 439 / SD 429, SD 450, SD 615/16/SD 415, SD 625, SD 632, SD 636, SD 650/52, SD 665, SD 675, SD 712 / SD 710 / SD 670, SD 730, SD 820, SD 820A, SD 835, SD 845 / SD 850, SD 855, SD 8CX, SDA660, SDM439, SDM630, SDM660, SDX20, Snapdragon_High_Med_2016, SXR1130

AnalysisAI

Improper validation of array index causes OOB write and then leads to memory corruption in MMCP in Snapdragon Auto, Snapdragon Compute, Snapdragon Consumer IOT, Snapdragon Industrial IOT, Snapdragon. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.

Technical ContextAI

This vulnerability is classified under CWE-129. Improper validation of array index causes OOB write and then leads to memory corruption in MMCP in Snapdragon Auto, Snapdragon Compute, Snapdragon Consumer IOT, Snapdragon Industrial IOT, Snapdragon IoT, Snapdragon Mobile, Snapdragon Voice & Music, Snapdragon Wearables in MDM9150, MDM9607, MDM9615, MDM9625, MDM9635M, MDM9640, MDM9650, MDM9655, MSM8909W, MSM8996AU, QCS605, Qualcomm 215, SD 210/SD 212/SD 205, SD 425, SD 427, SD 430, SD 435, SD 439 / SD 429, SD 450, SD 615/16/SD 415, SD 625, SD 632, SD 636, SD 650/52, SD 665, SD 675, SD 712 / SD 710 / SD 670, SD 730, SD 820, SD 820A, SD 835, SD 845 / SD 850, SD 855, SD 8CX, SDA660, SDM439, SDM630, SDM660, SDX20, Snapdragon_High_Med_2016, SXR1130 Affected products include: Qualcomm Mdm9150 Firmware, Qualcomm Mdm9607 Firmware, Qualcomm Mdm9615 Firmware, Qualcomm Mdm9625 Firmware, Qualcomm Mdm9635M Firmware.

RemediationAI

No vendor patch is available at time of analysis. Monitor vendor advisories for updates. Apply vendor patches when available. Implement network segmentation and monitoring as interim mitigations.

More in Mdm9150 Firmware

View all
CVE-2022-25720 CRITICAL
9.8 Oct 19

Memory corruption in WLAN due to out of bound array access during connect/roaming in Snapdragon Auto, Snapdragon Compute
CVE-2022-25687 CRITICAL
9.8 Oct 19

memory corruption in video due to buffer overflow while parsing asf clips in Snapdragon Auto, Snapdragon Compute, Snapdr
CVE-2022-22105 CRITICAL
9.8 Sep 16

Memory corruption in bluetooth due to integer overflow while processing HFP-UNIT profile in Snapdragon Auto, Snapdragon

CVE-2022-25651 CRITICAL
9.8 Jun 14

Memory corruption in bluetooth host due to integer overflow while processing BT HFP-UNIT profile in Snapdragon Auto, Sna
CVE-2021-1975 CRITICAL
9.8 Nov 12

Possible heap overflow due to improper length check of domain while parsing the DNS response in Snapdragon Auto, Snapdra
CVE-2021-1976 CRITICAL
9.8 Sep 17

A use after free can occur due to improper validation of P2P device address in PD Request frame in Snapdragon Auto, Snap
CVE-2021-1972 CRITICAL
9.8 Sep 08

Possible buffer overflow due to improper validation of device types during P2P search in Snapdragon Auto, Snapdragon Com
CVE-2021-1920 CRITICAL
9.8 Sep 08

Integer underflow can occur due to improper handling of incoming RTCP packets in Snapdragon Auto, Snapdragon Compute, Sn
CVE-2021-1919 CRITICAL
9.8 Sep 08

Integer underflow can occur when the RTCP length is lesser than than the actual blocks present in Snapdragon Auto, Snapd
CVE-2021-1916 CRITICAL
9.8 Sep 08

Possible buffer underflow due to lack of check for negative indices values when processing user provided input in Snapdr
CVE-2020-3657 CRITICAL
9.8 Nov 02

u'Remote code execution can happen by sending a carefully crafted POST query when Device configuration is accessed from

CVE-2020-3698 CRITICAL
9.8 Jul 30

Out of bound write while QoS DSCP mapping due to improper input validation for data received from association response f

Same weakness CWE-129 – Improper Validation of Array Index

View all
CVE-2016-9053 CRITICAL POC
9.8
CVE-2020-27485 CRITICAL POC
9.9
CVE-2020-27483 CRITICAL POC
9.9
CVE-2024-24563 CRITICAL POC
9.8
CVE-2017-8797 HIGH
7.5
CVE-2018-11489 HIGH POC
8.8
CVE-2026-56770 HIGH POC
8.7
CVE-2017-7228 HIGH POC
8.2

Same technique Buffer Overflow

View all
CVE-2017-7269 CRITICAL POC
9.8
CVE-2015-5119 CRITICAL POC
9.8
CVE-2015-3113 CRITICAL POC
9.8
CVE-2011-2462 CRITICAL POC
9.8
CVE-2009-0927 HIGH POC
8.8
CVE-2012-1889 HIGH POC
8.8
CVE-2017-11882 HIGH POC
7.8
CVE-2010-3333 HIGH POC
7.8

Share

CVE-2019-2258 vulnerability details – vuln.today
Back

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy