Skip to main content

Ar8035 Firmware CVE-2024-21473

CRITICAL
Improper Input Validation (CWE-20)
2024-04-01 product-security@qualcomm.com
Buffer Overflow Qualcomm Ar8035 Firmware Ar9380 Firmware Csr8811 Firmware Fastconnect 6900 Firmware Fastconnect 7800 Firmware Immersive Home 214 Firmware Immersive Home 216 Firmware Immersive Home 316 Firmware Immersive Home 318 Firmware Immersive Home 3210 Firmware Immersive Home 326 Firmware Ipq4018 Firmware Ipq4019 Firmware Ipq4028 Firmware Ipq4029 Firmware Ipq5010 Firmware Ipq5028 Firmware Ipq5300 Firmware Ipq5302 Firmware Ipq5312 Firmware Ipq5332 Firmware Ipq6000 Firmware Ipq6010 Firmware Ipq6018 Firmware Ipq6028 Firmware Ipq8064 Firmware Ipq8065 Firmware Ipq8068 Firmware Ipq8070 Firmware Ipq8070a Firmware Ipq8071 Firmware Ipq8071a Firmware Ipq8072 Firmware Ipq8072a Firmware Ipq8074 Firmware Ipq8074a Firmware Ipq8076 Firmware Ipq8076a Firmware Ipq8078 Firmware Ipq8078a Firmware Ipq8173 Firmware Ipq8174 Firmware Ipq9008 Firmware Ipq9554 Firmware Ipq9570 Firmware Ipq9574 Firmware Qca0000 Firmware Qca4024 Firmware Qca6428 Firmware Qca6438 Firmware Qca7500 Firmware Qca8072 Firmware Qca8075 Firmware Qca8081 Firmware Qca8082 Firmware Qca8084 Firmware Qca8085 Firmware Qca8337 Firmware Qca8386 Firmware Qca9880 Firmware Qca9886 Firmware Qca9888 Firmware Qca9889 Firmware Qca9898 Firmware Qca9980 Firmware Qca9984 Firmware Qca9985 Firmware Qca9986 Firmware Qca9990 Firmware Qca9992 Firmware Qca9994 Firmware Qcc710 Firmware Qcf8000 Firmware Qcf8001 Firmware Qcn5022 Firmware Qcn5024 Firmware Qcn5052 Firmware Qcn5054 Firmware Qcn5122 Firmware Qcn5124 Firmware Qcn5152 Firmware Qcn5154 Firmware Qcn5164 Firmware Qcn6023 Firmware Qcn6024 Firmware Qcn6100 Firmware Qcn6102 Firmware Qcn6112 Firmware Qcn6122 Firmware Qcn6132 Firmware Qcn6224 Firmware Qcn6274 Firmware Qcn6402 Firmware Qcn6412 Firmware Qcn6422 Firmware Qcn6432 Firmware Qcn9000 Firmware Qcn9001 Firmware Qcn9002 Firmware Qcn9003 Firmware Qcn9012 Firmware Qcn9022 Firmware Qcn9024 Firmware Qcn9070 Firmware Qcn9072 Firmware Qcn9074 Firmware Qcn9100 Firmware Qcn9274 Firmware Qfw7114 Firmware Qfw7124 Firmware Sdx55 Firmware Sdx65m Firmware Snapdragon X65 5g Modem Rf Firmware Snapdragon X75 5g Modem Rf Firmware Wcd9340 Firmware Wcd9380 Firmware Pmp8074 Firmware Qcn5021 Firmware Qcn5064 Firmware Qcn5550 Firmware Qca9558 Firmware Qcn5502 Firmware Qca9531 Firmware Qca9563 Firmware Qfe1922 Firmware Qfe1952 Firmware Qca9988 Firmware
9.8
CVSS 3.1 · Vendor: qualcomm
View

Vulnerability Assessment

Weakness
CWE
CWE-20
OWASP Top 10:2025
A05:2025 - Injection
ASVS 5.0
V2 - Validation and Business Logic Input validation, allowlisting
Impact

CVSS score of 9.8 (CRITICAL). Attack characteristics: network attack vector, low complexity, no privileges required, no user interaction not required.
Exploit ScenarioDerived

This vulnerability can be exploited remotely over the network. Successful exploitation could compromise the critical-severity affected system.
Act Now Prioritize within 24-48h. Why: CRITICAL severity.
No patch listed yet 0.7% exploitation probability (EPSS)

Get an e-mail when this CVE is exploited, patched or re-scored. Free account.

Alert me

AnalysisAI

Memory corruption while redirecting log file to any file location with any file name. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.

RemediationAI

No vendor patch is available at time of analysis. Monitor vendor advisories for updates. Apply vendor patches when available. Implement network segmentation and monitoring as interim mitigations.

Affects your stack

Find out whether the stacks and servers you run are on an affected version.

Checking this CVE against your own stacks and servers is part of the Basic plan and up.

Sign in to check
Technical ContextAI · show details

This vulnerability is classified under CWE-20. Memory corruption while redirecting log file to any file location with any file name. Affected products include: Qualcomm Ar8035 Firmware, Qualcomm Ar9380 Firmware, Qualcomm Csr8811 Firmware, Qualcomm Fastconnect 6900 Firmware, Qualcomm Fastconnect 7800 Firmware.

Know when Ar8035 Firmware gets its next vulnerability

  • Watch products and get an email when something new is published
  • Check this CVE against your own stack and servers
  • Exploit and PoC references, threat intelligence from 22 sources
Continue with Google Continue with GitHub

No credit card · 7-day full trial

Severity by source

Vendor (qualcomm) PRIMARY 9.8 CRITICAL
AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Primary rating from Vendor (qualcomm) · only source for this CVE.

CVSS VectorVendor: qualcomm

Attack Vector
Network
Attack Complexity
Low
Privileges Required
None
User Interaction
None
Scope
Unchanged
Confidentiality
High
Integrity
High
Availability
High

DescriptionCVE.org

Memory corruption while redirecting log file to any file location with any file name.

Threat Intelligence Overview

EPSS Score
0.7%
Top 53% exploitable
Data Quality
2 sources
Confidence: Low
NVD CVE.org EPSS

How this decision was reached

The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.

SignalValue
Severity CRITICAL
CISA KEV No
Public POC No
EPSS 0.7%
Patch available No
Active threat No
Deciding rule
CRITICAL severity
What every action level means
Emergency Immediate action required. Criteria: CRITICAL + in CISA KEV (actively exploited) without patch, OR CRITICAL + EPSS > 30% without patch, OR CRITICAL + active threat signals without patch.
Act Now Prioritize within 24-48h. Criteria: in KEV with patch available, OR CRITICAL + public POC, OR HIGH + EPSS > 10%, OR CRITICAL + active threat, OR any CRITICAL severity.
This Week Schedule remediation this week. Criteria: HIGH severity (CVSS 7.0-8.9). Patch within normal change window.
This Month Plan within 30 days. Criteria: MEDIUM severity (CVSS 4.0-6.9), lower exploitation probability. Include in regular patch cycle.
Monitor Track and reassess. Criteria: LOW severity (CVSS 0.1-3.9), minimal exploitation risk. No immediate action needed.

SSVC AssessmentENISA

SSVC Decision· derived
Scheduled
Exploitation· derived
None
System Exposure· derived
Open
Automatable· derived
Yes
Human Impact· derived
Medium

Priority Score

50
Low Medium High Critical
KEV: 0
EPSS: +1
CVSS: +49
PoC: 0
Weaponized: 0
Threat intel: 0
Gov advisory: 0

Attack Technique

Buffer Overflow HIGH

A buffer overflow occurs when a program writes more data to a memory buffer than it was allocated to hold, causing the excess data to spill into adjacent memory regions.

Affected Products (CPE)CVE.org

cpe:2.3:o:qualcomm:ar8035_firmware:-:*:*:*:*:*:*:*
cpe:2.3:o:qualcomm:ar9380_firmware:-:*:*:*:*:*:*:*
cpe:2.3:o:qualcomm:csr8811_firmware:-:*:*:*:*:*:*:*
cpe:2.3:o:qualcomm:fastconnect_6900_firmware:-:*:*:*:*:*:*:*
cpe:2.3:o:qualcomm:fastconnect_7800_firmware:-:*:*:*:*:*:*:*
cpe:2.3:o:qualcomm:immersive_home_214_firmware:-:*:*:*:*:*:*:*
cpe:2.3:o:qualcomm:immersive_home_216_firmware:-:*:*:*:*:*:*:*
cpe:2.3:o:qualcomm:immersive_home_316_firmware:-:*:*:*:*:*:*:*
cpe:2.3:o:qualcomm:immersive_home_318_firmware:-:*:*:*:*:*:*:*
cpe:2.3:o:qualcomm:immersive_home_3210_firmware:-:*:*:*:*:*:*:*
cpe:2.3:o:qualcomm:immersive_home_326_firmware:-:*:*:*:*:*:*:*
cpe:2.3:o:qualcomm:ipq4018_firmware:-:*:*:*:*:*:*:*
cpe:2.3:o:qualcomm:ipq4019_firmware:-:*:*:*:*:*:*:*
cpe:2.3:o:qualcomm:ipq4028_firmware:-:*:*:*:*:*:*:*
cpe:2.3:o:qualcomm:ipq4029_firmware:-:*:*:*:*:*:*:*
cpe:2.3:o:qualcomm:ipq5010_firmware:-:*:*:*:*:*:*:*
cpe:2.3:o:qualcomm:ipq5028_firmware:-:*:*:*:*:*:*:*
cpe:2.3:o:qualcomm:ipq5300_firmware:-:*:*:*:*:*:*:*
cpe:2.3:o:qualcomm:ipq5302_firmware:-:*:*:*:*:*:*:*
cpe:2.3:o:qualcomm:ipq5312_firmware:-:*:*:*:*:*:*:*
+ 107 more

More in Ar8035 Firmware

View all
CVE-2026-21385 HIGH POC
7.8 Mar 02

A Qualcomm chipset vulnerability (CVE-2026-21385) causes memory corruption through improper integer handling during memo
CVE-2023-33025 CRITICAL
9.8 Jan 02

Memory corruption in Data Modem when a non-standard SDP body, during a VOLTE call. Rated critical severity (CVSS 9.8), t
CVE-2024-21480 CRITICAL
9.8 May 06

Memory corruption while playing audio file having large-sized input buffer. Rated critical severity (CVSS 9.8), this vul
CVE-2024-21463 CRITICAL
9.8 Apr 01

Memory corruption while processing Codec2 during v13k decoder pitch synthesis. Rated critical severity (CVSS 9.8), this

CVE-2023-33083 CRITICAL
9.8 Dec 05

Memory corruption in WLAN Host while processing RRM beacon on the AP. Rated critical severity (CVSS 9.8), this vulnerabi
CVE-2023-33082 CRITICAL
9.8 Dec 05

Memory corruption while sending an Assoc Request having BTM Query or BTM Response containing MBO IE. Rated critical seve
CVE-2023-33045 CRITICAL
9.8 Nov 07

Memory corruption in WLAN Firmware while parsing a NAN management frame carrying a S3 attribute. Rated critical severity
CVE-2023-22388 CRITICAL
9.8 Nov 07

Memory Corruption in Multi-mode Call Processor while processing bit mask API. Rated critical severity (CVSS 9.8), this v
CVE-2023-33028 CRITICAL
9.8 Oct 03

Memory corruption in WLAN Firmware while doing a memory copy of pmk cache. Rated critical severity (CVSS 9.8), this vuln
CVE-2023-24855 CRITICAL
9.8 Oct 03

Memory corruption in Modem while processing security related configuration before AS Security Exchange. Rated critical s
CVE-2023-22385 CRITICAL
9.8 Oct 03

Memory Corruption in Data Modem while making a MO call or MT VOLTE call. Rated critical severity (CVSS 9.8), this vulner
CVE-2023-21631 CRITICAL
9.8 Jul 04

Weak Configuration due to improper input validation in Modem while processing LTE security mode command message received

Same weakness CWE-20 – Improper Input Validation

View all
CVE-2021-44228 CRITICAL POC
10.0
CVE-2024-3400 CRITICAL POC
10.0
CVE-2022-47966 CRITICAL POC
9.8
CVE-2023-22515 CRITICAL POC
9.8
CVE-2009-0927 HIGH POC
8.8
CVE-2017-9791 CRITICAL POC
9.8
CVE-2017-15944 CRITICAL POC
9.8
CVE-2019-0604 CRITICAL POC
9.8

Same technique Buffer Overflow

View all
CVE-2017-7269 CRITICAL POC
9.8
CVE-2015-5119 CRITICAL POC
9.8
CVE-2015-3113 CRITICAL POC
9.8
CVE-2011-2462 CRITICAL POC
9.8
CVE-2020-0796 CRITICAL POC
10.0
CVE-2019-11043 CRITICAL POC
9.8
CVE-2012-1889 HIGH POC
8.8

References

Advisories & patches
ADVISORY https://docs.qualcomm.com/product/publicresources/securitybulletin/april-2024-bulletin.html

Search Externally

GitHub PoC Exploit-DB PacketStorm Snyk Rapid7 Nuclei Templates Trickest PoC
Back

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy