Skip to main content

Csr8811 Firmware CVE-2023-33053

HIGH
Improper Validation of Array Index (CWE-129)
2023-12-05 product-security@qualcomm.com
Buffer Overflow Qualcomm Csr8811 Firmware Immersive Home 214 Platform Firmware Immersive Home 216 Platform Firmware Immersive Home 316 Platform Firmware Immersive Home 318 Platform Firmware Immersive Home 3210 Platform Firmware Immersive Home 326 Platform Firmware Ipq5010 Firmware Ipq5028 Firmware Ipq5332 Firmware Ipq6000 Firmware Ipq6010 Firmware Ipq6018 Firmware Ipq6028 Firmware Ipq8070a Firmware Ipq8071a Firmware Ipq8072a Firmware Ipq8074a Firmware Ipq8076 Firmware Ipq8076a Firmware Ipq8078 Firmware Ipq8078a Firmware Ipq8173 Firmware Ipq8174 Firmware Ipq9008 Firmware Ipq9554 Firmware Ipq9570 Firmware Ipq9574 Firmware Qam8255p Firmware Qam8295p Firmware Qam8650p Firmware Qam8775p Firmware Qca0000 Firmware Qca4024 Firmware Qca6174a Firmware Qca6574 Firmware Qca6574a Firmware Qca6574au Firmware Qca6595 Firmware Qca6595au Firmware Qca6696 Firmware Qca6698aq Firmware Qca6797aq Firmware Qca8075 Firmware Qca8081 Firmware Qca8082 Firmware Qca8084 Firmware Qca8085 Firmware Qca8386 Firmware Qca9377 Firmware Qca9888 Firmware Qca9889 Firmware Qcf8000 Firmware Qcf8001 Firmware Qcm6490 Firmware Qcn5022 Firmware Qcn5024 Firmware Qcn5052 Firmware Qcn5122 Firmware Qcn5124 Firmware Qcn5152 Firmware Qcn5154 Firmware Qcn5164 Firmware Qcn6023 Firmware Qcn6024 Firmware Qcn6112 Firmware Qcn6122 Firmware Qcn6132 Firmware Qcn9000 Firmware Qcn9012 Firmware Qcn9022 Firmware Qcn9024 Firmware Qcn9070 Firmware Qcn9072 Firmware Qcn9074 Firmware Qcn9100 Firmware Qcn9274 Firmware Qcs6490 Firmware Sa4150p Firmware Sa4155p Firmware Sa6145p Firmware Sa6150p Firmware Sa6155p Firmware Sa8145p Firmware Sa8150p Firmware Sa8155p Firmware Sa8195p Firmware Sa8255p Firmware Sa8295p Firmware Sa8770p Firmware Sa8775p Firmware Sa9000p Firmware Sdx55 Firmware Sdx65m Firmware Snapdragon 8 Gen 1 Mobile Platform Firmware Snapdragon Auto 5g Modem Rf Firmware Snapdragon X12 Lte Modem Firmware Snapdragon X65 5g Modem Rf System Firmware Sw5100 Firmware Sw5100p Firmware Video Collaboration Vc3 Platform Firmware Wcd9335 Firmware Wcd9370 Firmware Wcd9375 Firmware Wcd9380 Firmware Wcd9385 Firmware Wcn3980 Firmware Wcn3988 Firmware Wsa8830 Firmware Wsa8835 Firmware Qcn9013 Firmware Snapdragon W5 Gen 1 Wearable Platform Firmware Wcn6750 Firmware Wcn685X 1 Firmware Wcn785X 1 Firmware Wcn685X 5 Firmware Wcn785X 5 Firmware
7.8
CVSS 3.1 · NVD
View

Vulnerability Assessment

Weakness
CWE
OWASP Top 10:2025
A05:2025 - Injection
ASVS 5.0
V2 - Validation and Business Logic Array index validation
Impact

CVSS score of 7.8 (HIGH). Attack characteristics: local attack vector, low complexity, low privileges required, no user interaction not required.

Exploit ScenarioDerived

Successful exploitation could compromise the high-severity affected system.

This Week Schedule remediation this week. Why: HIGH severity (CVSS 7.0-8.9).
Patch available 0.1% exploitation probability (EPSS)

Get an e-mail when this CVE is exploited, patched or re-scored. Free account.

Alert me

AnalysisAI

Memory corruption in Kernel while parsing metadata. Rated high severity (CVSS 7.8), this vulnerability is low attack complexity.

RemediationAI

A vendor patch is available. Apply the latest security update as soon as possible. Apply vendor patches when available. Implement network segmentation and monitoring as interim mitigations.

Affects your stack

Find out whether the stacks and servers you run are on an affected version.

Checking this CVE against your own stacks and servers is part of the Basic plan and up.

Technical ContextAI · show details

This vulnerability is classified under CWE-129. Affected products include: Qualcomm Csr8811 Firmware, Qualcomm Wcn6750 Firmware, Qualcomm Wcn685X-5 Firmware, Qualcomm Wcn685X-1 Firmware, Qualcomm Wcn785X-1 Firmware.

Know when Csr8811 Firmware gets its next vulnerability

  • Watch products and get an email when something new is published
  • Check this CVE against your own stack and servers
  • Exploit and PoC references, threat intelligence from 22 sources

No credit card · 7-day full trial

Severity by source

NVD PRIMARY 7.8 HIGH
AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

Attack Vector
Local
Attack Complexity
Low
Privileges Required
Low
User Interaction
None
Scope
Unchanged
Confidentiality
High
Integrity
High
Availability
High

DescriptionNVD

Memory corruption in Kernel while parsing metadata.

Threat Intelligence Overview

EPSS Score
0.1%
Top 96% exploitable
Data Quality
2 sources
Confidence: Low

How this decision was reached

The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.

SignalValue
Severity HIGH
CISA KEV No
Public POC No
EPSS 0.1%
Patch available Yes
Active threat No
Deciding rule
HIGH severity (CVSS 7.0-8.9)
What every action level means
Emergency Immediate action required. Criteria: CRITICAL + in CISA KEV (actively exploited) without patch, OR CRITICAL + EPSS > 30% without patch, OR CRITICAL + active threat signals without patch.
Act Now Prioritize within 24-48h. Criteria: in KEV with patch available, OR CRITICAL + public POC, OR HIGH + EPSS > 10%, OR CRITICAL + active threat, OR any CRITICAL severity.
This Week Schedule remediation this week. Criteria: HIGH severity (CVSS 7.0-8.9). Patch within normal change window.
This Month Plan within 30 days. Criteria: MEDIUM severity (CVSS 4.0-6.9), lower exploitation probability. Include in regular patch cycle.
Monitor Track and reassess. Criteria: LOW severity (CVSS 0.1-3.9), minimal exploitation risk. No immediate action needed.

SSVC AssessmentENISA

SSVC Decision· derived
Defer
Exploitation· derived
None
System Exposure· derived
Small
Automatable· derived
No
Human Impact· derived
Medium

Priority Score

39
Low Medium High Critical
KEV: 0
EPSS: 0
CVSS: +39
PoC: 0
Weaponized: 0
Threat intel: 0
Gov advisory: 0

Attack Technique

A buffer overflow occurs when a program writes more data to a memory buffer than it was allocated to hold, causing the excess data to spill into adjacent memory regions.

Affected Products (CPE)NVD

cpe:2.3:o:qualcomm:csr8811_firmware:-:*:*:*:*:*:*:*
cpe:2.3:o:qualcomm:wcn6750_firmware:-:*:*:*:*:*:*:*
cpe:2.3:o:qualcomm:wcn685x-5_firmware:-:*:*:*:*:*:*:*
cpe:2.3:o:qualcomm:wcn685x-1_firmware:-:*:*:*:*:*:*:*
cpe:2.3:o:qualcomm:wcn785x-1_firmware:-:*:*:*:*:*:*:*
cpe:2.3:o:qualcomm:wcn785x-5_firmware:-:*:*:*:*:*:*:*
cpe:2.3:o:qualcomm:immersive_home_214_platform_firmware:-:*:*:*:*:*:*:*
cpe:2.3:o:qualcomm:immersive_home_216_platform_firmware:-:*:*:*:*:*:*:*
cpe:2.3:o:qualcomm:immersive_home_316_platform_firmware:-:*:*:*:*:*:*:*
cpe:2.3:o:qualcomm:immersive_home_318_platform_firmware:-:*:*:*:*:*:*:*
cpe:2.3:o:qualcomm:immersive_home_3210_platform_firmware:-:*:*:*:*:*:*:*
cpe:2.3:o:qualcomm:immersive_home_326_platform_firmware:-:*:*:*:*:*:*:*
cpe:2.3:o:qualcomm:ipq5010_firmware:-:*:*:*:*:*:*:*
cpe:2.3:o:qualcomm:ipq5028_firmware:-:*:*:*:*:*:*:*
cpe:2.3:o:qualcomm:ipq5332_firmware:-:*:*:*:*:*:*:*
cpe:2.3:o:qualcomm:ipq6000_firmware:-:*:*:*:*:*:*:*
cpe:2.3:o:qualcomm:ipq6010_firmware:-:*:*:*:*:*:*:*
cpe:2.3:o:qualcomm:ipq6018_firmware:-:*:*:*:*:*:*:*
cpe:2.3:o:qualcomm:ipq6028_firmware:-:*:*:*:*:*:*:*
cpe:2.3:o:qualcomm:ipq8070a_firmware:-:*:*:*:*:*:*:*
+ 97 more
CVE-2024-33066 CRITICAL
9.8 Oct 07

Memory corruption while redirecting log file to any file location with any file name. Rated critical severity (CVSS 9.8)

CVE-2024-21473 CRITICAL
9.8 Apr 01

Memory corruption while redirecting log file to any file location with any file name. Rated critical severity (CVSS 9.8)

CVE-2023-33083 CRITICAL
9.8 Dec 05

Memory corruption in WLAN Host while processing RRM beacon on the AP. Rated critical severity (CVSS 9.8), this vulnerabi

CVE-2023-33082 CRITICAL
9.8 Dec 05

Memory corruption while sending an Assoc Request having BTM Query or BTM Response containing MBO IE. Rated critical seve

CVE-2023-33045 CRITICAL
9.8 Nov 07

Memory corruption in WLAN Firmware while parsing a NAN management frame carrying a S3 attribute. Rated critical severity

CVE-2023-33028 CRITICAL
9.8 Oct 03

Memory corruption in WLAN Firmware while doing a memory copy of pmk cache. Rated critical severity (CVSS 9.8), this vuln

CVE-2022-25748 CRITICAL
9.8 Oct 19

Memory corruption in WLAN due to integer overflow to buffer overflow while parsing GTK frames. Rated critical severity (

CVE-2021-1976 CRITICAL
9.8 Sep 17

A use after free can occur due to improper validation of P2P device address in PD Request frame in Snapdragon Auto, Snap

CVE-2021-1972 CRITICAL
9.8 Sep 08

Possible buffer overflow due to improper validation of device types during P2P search in Snapdragon Auto, Snapdragon Com

CVE-2021-1965 CRITICAL POC
9.8 Jul 13

Possible buffer overflow due to lack of parameter length check during MBSSID scan IE parse in Snapdragon Auto, Snapdrago

CVE-2023-33032 CRITICAL
9.3 Jan 02

Memory corruption in TZ Secure OS while requesting a memory allocation from TA region. Rated critical severity (CVSS 9.3

CVE-2023-33030 CRITICAL
9.3 Jan 02

Memory corruption in HLOS while running playready use-case. Rated critical severity (CVSS 9.3), this vulnerability is no

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy