What is the CVSS score of CVE-2024-21482?

CVE-2024-21482 has a CVSS 3.1 base score of 7.8 (High). CVSS vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.1%.

Is there a patch available for CVE-2024-21482?

Yes, a patch is available for CVE-2024-21482. Update the affected software to the latest version immediately.

Csr8811 Firmware CVE-2024-21482

Q: Which versions of Csr8811 Firmware are affected by CVE-2024-21482?

Memory corruption during the secure boot process, when the `bootm` command is used, it bypasses the authentication of the kernel/rootfs image.. A patch is available.

HIGH

Buffer Overflow (CWE-119)

2024-07-01 product-security@qualcomm.com

Buffer Overflow Qualcomm Csr8811 Firmware Immersive Home 214 Platform Firmware Immersive Home 216 Platform Firmware Immersive Home 316 Platform Firmware Immersive Home 318 Platform Firmware Immersive Home 3210 Platform Firmware Immersive Home 326 Platform Firmware Ipq5010 Firmware Ipq5028 Firmware Ipq5302 Firmware Ipq5312 Firmware Ipq5332 Firmware Ipq6000 Firmware Ipq6010 Firmware Ipq6018 Firmware Ipq6028 Firmware Ipq8070a Firmware Ipq8071a Firmware Ipq8072a Firmware Ipq8074a Firmware Ipq8076 Firmware Ipq8076a Firmware Ipq8078 Firmware Ipq8078a Firmware Ipq8173 Firmware Ipq8174 Firmware Ipq9008 Firmware Ipq9554 Firmware Ipq9570 Firmware Ipq9574 Firmware Qca4024 Firmware Qca8075 Firmware Qca8081 Firmware Qca8082 Firmware Qca8084 Firmware Qca8085 Firmware Qca8386 Firmware Qca9888 Firmware Qca9889 Firmware Qcf8000 Firmware Qcf8001 Firmware Qcn5022 Firmware Qcn5024 Firmware Qcn5052 Firmware Qcn5122 Firmware Qcn5124 Firmware Qcn5152 Firmware Qcn5154 Firmware Qcn5164 Firmware Qcn6023 Firmware Qcn6024 Firmware Qcn6112 Firmware Qcn6122 Firmware Qcn6132 Firmware Qcn6402 Firmware Qcn6412 Firmware Qcn6422 Firmware Qcn6432 Firmware Qcn9000 Firmware Qcn9022 Firmware Qcn9024 Firmware Qcn9070 Firmware Qcn9072 Firmware Qcn9074 Firmware Qcn9100 Firmware Qcn9274 Firmware Sdx55 Firmware Sdx65m Firmware Snapdragon X65 5g Modem Rf System Firmware

7.8

CVSS 3.1 · NVD

View

Vulnerability Assessment

Weakness	CWE CWE-119 ASVS 5.0 V15 - Secure Coding and Architecture Bounds checking, buffer size validation MITRE ATT&CK 2 techniques across 2 tactics: Execution, Privilege Escalation The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. Sign in to read
Impact	CVSS score of 7.8 (HIGH). Attack characteristics: local attack vector, low complexity, low privileges required, no user interaction not required.
Exploit ScenarioDerived	A local attacker with access to the system could corrupt memory to execute arbitrary code or crash the application.

This Week Schedule remediation this week. Why: HIGH severity (CVSS 7.0-8.9).

Patch available 0.1% exploitation probability (EPSS)

Get an e-mail when this CVE is exploited, patched or re-scored. Free account.

Alert me

AnalysisAI

Memory corruption during the secure boot process, when the bootm command is used, it bypasses the authentication of the kernel/rootfs image. Rated high severity (CVSS 7.8), this vulnerability is low attack complexity. This Buffer Overflow vulnerability could allow attackers to corrupt memory to execute arbitrary code or crash the application.

RemediationAI

A vendor patch is available. Apply the latest security update as soon as possible. Use memory-safe languages or bounds-checking. Enable ASLR, DEP/NX, stack canaries. Use safe string functions.

Affects your stack

Find out whether the stacks and servers you run are on an affected version.

Checking this CVE against your own stacks and servers is part of the Basic plan and up.

Technical ContextAI · show details

This vulnerability is classified as Buffer Overflow (CWE-119), which allows attackers to corrupt memory to execute arbitrary code or crash the application. Memory corruption during the secure boot process, when the bootm command is used, it bypasses the authentication of the kernel/rootfs image. Affected products include: Qualcomm Csr8811 Firmware, Qualcomm Immersive Home 214 Platform Firmware, Qualcomm Immersive Home 216 Platform Firmware, Qualcomm Immersive Home 316 Platform Firmware, Qualcomm Immersive Home 318 Platform Firmware.

Know when Csr8811 Firmware gets its next vulnerability

Watch products and get an email when something new is published
Check this CVE against your own stack and servers
Exploit and PoC references, threat intelligence from 22 sources

Continue with Google Continue with GitHub

No credit card · 7-day full trial

Severity by source

NVD PRIMARY 7.8 HIGH

AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

Attack Vector

Local

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

DescriptionNVD

Memory corruption during the secure boot process, when the bootm command is used, it bypasses the authentication of the kernel/rootfs image.

Threat Intelligence Overview

EPSS Score

0.1%

Top 99% exploitable

Data Quality

2 sources

Confidence: Low

NVD

CVE.org

EPSS

How this decision was reached

The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.

SignalValue

Severity HIGH

CISA KEV No

Public POC No

EPSS 0.1%

Patch available Yes

Active threat No

Deciding rule

HIGH severity (CVSS 7.0-8.9)

What every action level means

Emergency Immediate action required. Criteria: CRITICAL + in CISA KEV (actively exploited) without patch, OR CRITICAL + EPSS > 30% without patch, OR CRITICAL + active threat signals without patch.

Act Now Prioritize within 24-48h. Criteria: in KEV with patch available, OR CRITICAL + public POC, OR HIGH + EPSS > 10%, OR CRITICAL + active threat, OR any CRITICAL severity.

This Week Schedule remediation this week. Criteria: HIGH severity (CVSS 7.0-8.9). Patch within normal change window.

This Month Plan within 30 days. Criteria: MEDIUM severity (CVSS 4.0-6.9), lower exploitation probability. Include in regular patch cycle.

Monitor Track and reassess. Criteria: LOW severity (CVSS 0.1-3.9), minimal exploitation risk. No immediate action needed.

SSVC AssessmentENISA

SSVC Decision· derived

Defer

Exploitation· derived

None

System Exposure· derived

Small

Automatable· derived

Human Impact· derived

Medium

Priority Score

Low Medium High Critical

KEV: 0

EPSS: 0

CVSS: +39

PoC: 0

Weaponized: 0

Threat intel: 0

Gov advisory: 0

Attack Technique

Buffer Overflow HIGH

A buffer overflow occurs when a program writes more data to a memory buffer than it was allocated to hold, causing the excess data to spill into adjacent memory regions.

Affected Products (CPE)NVD

cpe:2.3:o:qualcomm:csr8811_firmware:-:*:*:*:*:*:*:*

cpe:2.3:o:qualcomm:immersive_home_214_platform_firmware:-:*:*:*:*:*:*:*

cpe:2.3:o:qualcomm:immersive_home_216_platform_firmware:-:*:*:*:*:*:*:*

cpe:2.3:o:qualcomm:immersive_home_316_platform_firmware:-:*:*:*:*:*:*:*

cpe:2.3:o:qualcomm:immersive_home_318_platform_firmware:-:*:*:*:*:*:*:*

cpe:2.3:o:qualcomm:immersive_home_3210_platform_firmware:-:*:*:*:*:*:*:*

cpe:2.3:o:qualcomm:immersive_home_326_platform_firmware:-:*:*:*:*:*:*:*

cpe:2.3:o:qualcomm:ipq5010_firmware:-:*:*:*:*:*:*:*

cpe:2.3:o:qualcomm:ipq5028_firmware:-:*:*:*:*:*:*:*

cpe:2.3:o:qualcomm:ipq5302_firmware:-:*:*:*:*:*:*:*

cpe:2.3:o:qualcomm:ipq5312_firmware:-:*:*:*:*:*:*:*

cpe:2.3:o:qualcomm:ipq5332_firmware:-:*:*:*:*:*:*:*

cpe:2.3:o:qualcomm:ipq6000_firmware:-:*:*:*:*:*:*:*

cpe:2.3:o:qualcomm:ipq6010_firmware:-:*:*:*:*:*:*:*

cpe:2.3:o:qualcomm:ipq6018_firmware:-:*:*:*:*:*:*:*

cpe:2.3:o:qualcomm:ipq6028_firmware:-:*:*:*:*:*:*:*

cpe:2.3:o:qualcomm:ipq8070a_firmware:-:*:*:*:*:*:*:*

cpe:2.3:o:qualcomm:ipq8071a_firmware:-:*:*:*:*:*:*:*

cpe:2.3:o:qualcomm:ipq8072a_firmware:-:*:*:*:*:*:*:*

cpe:2.3:o:qualcomm:ipq8074a_firmware:-:*:*:*:*:*:*:*

+ 49 more

More in Csr8811 Firmware

View all

CVE-2024-33066 CRITICAL Act Now

9.8 Oct 07

Memory corruption while redirecting log file to any file location with any file name. Rated critical severity (CVSS 9.8)

CVE-2024-21473 CRITICAL Act Now

9.8 Apr 01

Memory corruption while redirecting log file to any file location with any file name. Rated critical severity (CVSS 9.8)

CVE-2023-33083 CRITICAL Act Now

9.8 Dec 05

Memory corruption in WLAN Host while processing RRM beacon on the AP. Rated critical severity (CVSS 9.8), this vulnerabi

CVE-2023-33082 CRITICAL Act Now

9.8 Dec 05

Memory corruption while sending an Assoc Request having BTM Query or BTM Response containing MBO IE. Rated critical seve

CVE-2023-33045 CRITICAL Act Now

9.8 Nov 07

Memory corruption in WLAN Firmware while parsing a NAN management frame carrying a S3 attribute. Rated critical severity

CVE-2023-33028 CRITICAL Act Now

9.8 Oct 03

Memory corruption in WLAN Firmware while doing a memory copy of pmk cache. Rated critical severity (CVSS 9.8), this vuln

CVE-2022-25748 CRITICAL Act Now

9.8 Oct 19

Memory corruption in WLAN due to integer overflow to buffer overflow while parsing GTK frames. Rated critical severity (

CVE-2021-1976 CRITICAL Act Now

9.8 Sep 17

A use after free can occur due to improper validation of P2P device address in PD Request frame in Snapdragon Auto, Snap

CVE-2021-1972 CRITICAL Act Now

9.8 Sep 08

Possible buffer overflow due to improper validation of device types during P2P search in Snapdragon Auto, Snapdragon Com

CVE-2021-1965 CRITICAL Act Now POC

9.8 Jul 13

Possible buffer overflow due to lack of parameter length check during MBSSID scan IE parse in Snapdragon Auto, Snapdrago

CVE-2023-33032 CRITICAL Act Now

9.3 Jan 02

Memory corruption in TZ Secure OS while requesting a memory allocation from TA region. Rated critical severity (CVSS 9.3

CVE-2023-33030 CRITICAL Act Now

9.3 Jan 02

Memory corruption in HLOS while running playready use-case. Rated critical severity (CVSS 9.3), this vulnerability is no

Same weakness CWE-119 – Buffer Overflow

View all

CVE-2020-0796 CRITICAL POC

10.0

CVE-2017-11882 HIGH POC

7.8

CVE-2014-6332 HIGH POC

8.8

CVE-2015-2426 HIGH POC

8.8

CVE-2013-3918 HIGH POC

8.8

CVE-2023-4966 HIGH POC

7.5

CVE-2017-11774 HIGH POC

7.8

CVE-2013-3660 HIGH POC

7.8

Same technique Buffer Overflow

View all

CVE-2017-7269 CRITICAL POC

9.8

CVE-2015-5119 CRITICAL POC

9.8

CVE-2015-3113 CRITICAL POC

9.8

CVE-2011-2462 CRITICAL POC

9.8

CVE-2019-11043 CRITICAL POC

9.8

CVE-2009-0927 HIGH POC

8.8

CVE-2012-1889 HIGH POC

8.8

References

Advisories & patches

PATCH https://docs.qualcomm.com/product/publicresources/securitybulletin/july-2024-bulletin.html

Search Externally

GitHub PoC

Exploit-DB PacketStorm Snyk Rapid7 Nuclei Templates Trickest PoC

Back