What is the CVSS score of CVE-2024-33066?

CVE-2024-33066 has a CVSS 3.1 base score of 9.8 (Critical). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.6%.

Csr8811 Firmware CVE-2024-33066

CRITICAL

Improper Input Validation (CWE-20)

2024-10-07 product-security@qualcomm.com

Buffer Overflow Qualcomm Csr8811 Firmware Immersive Home 214 Platform Firmware Immersive Home 216 Platform Firmware Immersive Home 316 Platform Firmware Immersive Home 318 Platform Firmware Immersive Home 3210 Platform Firmware Immersive Home 326 Platform Firmware Ipq5010 Firmware Ipq5028 Firmware Ipq5300 Firmware Ipq5302 Firmware Ipq5312 Firmware Ipq5332 Firmware Ipq6000 Firmware Ipq6010 Firmware Ipq6018 Firmware Ipq6028 Firmware Ipq8070a Firmware Ipq8071a Firmware Ipq8072a Firmware Ipq8074a Firmware Ipq8076 Firmware Ipq8076a Firmware Ipq8078 Firmware Ipq8078a Firmware Ipq8173 Firmware Ipq8174 Firmware Ipq9008 Firmware Ipq9554 Firmware Ipq9574 Firmware Qca4024 Firmware Qca8075 Firmware Qca8081 Firmware Qca8082 Firmware Qca8084 Firmware Qca8085 Firmware Qca8386 Firmware Qca9888 Firmware Qca9889 Firmware Qcf8000 Firmware Qcf8001 Firmware Qcn5022 Firmware Qcn5024 Firmware Qcn5052 Firmware Qcn5122 Firmware Qcn5124 Firmware Qcn5152 Firmware Qcn5154 Firmware Qcn5164 Firmware Qcn6023 Firmware Qcn6024 Firmware Qcn6112 Firmware Qcn6122 Firmware Qcn6132 Firmware Qcn6402 Firmware Qcn6412 Firmware Qcn6422 Firmware Qcn6432 Firmware Qcn9000 Firmware Qcn9022 Firmware Qcn9024 Firmware Qcn9070 Firmware Qcn9072 Firmware Qcn9074 Firmware Qcn9100 Firmware Qcn9160 Firmware Qcn9274 Firmware Qxm8083 Firmware Sdx55 Firmware Sdx65m Firmware Snapdragon X65 5g Modem Rf System Firmware

9.8

CVSS 3.1 · Vendor: qualcomm

View

Vulnerability Assessment

Weakness	CWE CWE-20 OWASP Top 10:2025 A05:2025 - Injection ASVS 5.0 V2 - Validation and Business Logic Input validation, allowlisting
Impact	CVSS score of 9.8 (CRITICAL). Attack characteristics: network attack vector, low complexity, no privileges required, no user interaction not required.
Exploit ScenarioDerived	This vulnerability can be exploited remotely over the network. Successful exploitation could compromise the critical-severity affected system.

Act Now Prioritize within 24-48h. Why: CRITICAL severity.

No patch listed yet 0.6% exploitation probability (EPSS)

Get an e-mail when this CVE is exploited, patched or re-scored. Free account.

Alert me

AnalysisAI

Memory corruption while redirecting log file to any file location with any file name. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.

RemediationAI

No vendor patch is available at time of analysis. Monitor vendor advisories for updates. Apply vendor patches when available. Implement network segmentation and monitoring as interim mitigations.

Affects your stack

Find out whether the stacks and servers you run are on an affected version.

Checking this CVE against your own stacks and servers is part of the Basic plan and up.

Technical ContextAI · show details

This vulnerability is classified under CWE-20. Memory corruption while redirecting log file to any file location with any file name. Affected products include: Qualcomm Snapdragon X65 5G Modem-Rf System Firmware, Qualcomm Sdx65M Firmware, Qualcomm Sdx55 Firmware, Qualcomm Qxm8083 Firmware, Qualcomm Qcn9274 Firmware.

Know when Csr8811 Firmware gets its next vulnerability

Watch products and get an email when something new is published
Check this CVE against your own stack and servers
Exploit and PoC references, threat intelligence from 22 sources

Continue with Google Continue with GitHub

No credit card · 7-day full trial

Severity by source

Vendor (qualcomm) PRIMARY 9.8 CRITICAL

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Primary rating from Vendor (qualcomm) · only source for this CVE.

CVSS VectorVendor: qualcomm

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

DescriptionCVE.org

Memory corruption while redirecting log file to any file location with any file name.

Threat Intelligence Overview

EPSS Score

0.6%

Top 56% exploitable

Data Quality

2 sources

Confidence: Low

NVD

CVE.org

EPSS

How this decision was reached

The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.

SignalValue

Severity CRITICAL

CISA KEV No

Public POC No

EPSS 0.6%

Patch available No

Active threat No

Deciding rule

CRITICAL severity

What every action level means

Emergency Immediate action required. Criteria: CRITICAL + in CISA KEV (actively exploited) without patch, OR CRITICAL + EPSS > 30% without patch, OR CRITICAL + active threat signals without patch.

Act Now Prioritize within 24-48h. Criteria: in KEV with patch available, OR CRITICAL + public POC, OR HIGH + EPSS > 10%, OR CRITICAL + active threat, OR any CRITICAL severity.

This Week Schedule remediation this week. Criteria: HIGH severity (CVSS 7.0-8.9). Patch within normal change window.

This Month Plan within 30 days. Criteria: MEDIUM severity (CVSS 4.0-6.9), lower exploitation probability. Include in regular patch cycle.

Monitor Track and reassess. Criteria: LOW severity (CVSS 0.1-3.9), minimal exploitation risk. No immediate action needed.

SSVC AssessmentENISA

SSVC Decision· derived

Scheduled

Exploitation· derived

None

System Exposure· derived

Open

Automatable· derived

Yes

Human Impact· derived

Medium

Priority Score

Low Medium High Critical

KEV: 0

EPSS: +1

CVSS: +49

PoC: 0

Weaponized: 0

Threat intel: 0

Gov advisory: 0

Attack Technique

Buffer Overflow HIGH

A buffer overflow occurs when a program writes more data to a memory buffer than it was allocated to hold, causing the excess data to spill into adjacent memory regions.

Affected Products (CPE)CVE.org

cpe:2.3:o:qualcomm:snapdragon_x65_5g_modem-rf_system_firmware:-:*:*:*:*:*:*:*

cpe:2.3:o:qualcomm:sdx65m_firmware:-:*:*:*:*:*:*:*

cpe:2.3:o:qualcomm:sdx55_firmware:-:*:*:*:*:*:*:*

cpe:2.3:o:qualcomm:qxm8083_firmware:-:*:*:*:*:*:*:*

cpe:2.3:o:qualcomm:qcn9274_firmware:-:*:*:*:*:*:*:*

cpe:2.3:o:qualcomm:qcn9160_firmware:-:*:*:*:*:*:*:*

cpe:2.3:o:qualcomm:qcn9100_firmware:-:*:*:*:*:*:*:*

cpe:2.3:o:qualcomm:qcn9074_firmware:-:*:*:*:*:*:*:*

cpe:2.3:o:qualcomm:qcn9072_firmware:-:*:*:*:*:*:*:*

cpe:2.3:o:qualcomm:qcn9070_firmware:-:*:*:*:*:*:*:*

cpe:2.3:o:qualcomm:qcn9024_firmware:-:*:*:*:*:*:*:*

cpe:2.3:o:qualcomm:qcn9022_firmware:-:*:*:*:*:*:*:*

cpe:2.3:o:qualcomm:qcn9000_firmware:-:*:*:*:*:*:*:*

cpe:2.3:o:qualcomm:qcn6432_firmware:-:*:*:*:*:*:*:*

cpe:2.3:o:qualcomm:qcn6422_firmware:-:*:*:*:*:*:*:*

cpe:2.3:o:qualcomm:qcn6412_firmware:-:*:*:*:*:*:*:*

cpe:2.3:o:qualcomm:qcn6402_firmware:-:*:*:*:*:*:*:*

cpe:2.3:o:qualcomm:qcn6132_firmware:-:*:*:*:*:*:*:*

cpe:2.3:o:qualcomm:qcn6122_firmware:-:*:*:*:*:*:*:*

cpe:2.3:o:qualcomm:qcn6112_firmware:-:*:*:*:*:*:*:*

+ 51 more

More in Csr8811 Firmware

View all

CVE-2024-21473 CRITICAL Act Now

9.8 Apr 01

Memory corruption while redirecting log file to any file location with any file name. Rated critical severity (CVSS 9.8)

CVE-2023-33083 CRITICAL Act Now

9.8 Dec 05

Memory corruption in WLAN Host while processing RRM beacon on the AP. Rated critical severity (CVSS 9.8), this vulnerabi

CVE-2023-33082 CRITICAL Act Now

9.8 Dec 05

Memory corruption while sending an Assoc Request having BTM Query or BTM Response containing MBO IE. Rated critical seve

CVE-2023-33045 CRITICAL Act Now

9.8 Nov 07

Memory corruption in WLAN Firmware while parsing a NAN management frame carrying a S3 attribute. Rated critical severity

CVE-2023-33028 CRITICAL Act Now

9.8 Oct 03

Memory corruption in WLAN Firmware while doing a memory copy of pmk cache. Rated critical severity (CVSS 9.8), this vuln

CVE-2022-25748 CRITICAL Act Now

9.8 Oct 19

Memory corruption in WLAN due to integer overflow to buffer overflow while parsing GTK frames. Rated critical severity (

CVE-2021-1976 CRITICAL Act Now

9.8 Sep 17

A use after free can occur due to improper validation of P2P device address in PD Request frame in Snapdragon Auto, Snap

CVE-2021-1972 CRITICAL Act Now

9.8 Sep 08

Possible buffer overflow due to improper validation of device types during P2P search in Snapdragon Auto, Snapdragon Com

CVE-2021-1965 CRITICAL Act Now POC

9.8 Jul 13

Possible buffer overflow due to lack of parameter length check during MBSSID scan IE parse in Snapdragon Auto, Snapdrago

CVE-2023-33032 CRITICAL Act Now

9.3 Jan 02

Memory corruption in TZ Secure OS while requesting a memory allocation from TA region. Rated critical severity (CVSS 9.3

CVE-2023-33030 CRITICAL Act Now

9.3 Jan 02

Memory corruption in HLOS while running playready use-case. Rated critical severity (CVSS 9.3), this vulnerability is no

CVE-2022-25719 CRITICAL Act Now

9.1 Oct 19

Information disclosure in WLAN due to improper length check while processing authentication handshake in Snapdragon Auto

Same weakness CWE-20 – Improper Input Validation

View all

CVE-2021-44228 CRITICAL POC

10.0

CVE-2024-3400 CRITICAL POC

10.0

CVE-2022-47966 CRITICAL POC

9.8

CVE-2023-22515 CRITICAL POC

9.8

CVE-2009-0927 HIGH POC

8.8

CVE-2017-9791 CRITICAL POC

9.8

CVE-2017-15944 CRITICAL POC

9.8

CVE-2019-0604 CRITICAL POC

9.8

Same technique Buffer Overflow

View all

CVE-2017-7269 CRITICAL POC

9.8

CVE-2015-5119 CRITICAL POC

9.8

CVE-2015-3113 CRITICAL POC

9.8

CVE-2011-2462 CRITICAL POC

9.8

CVE-2020-0796 CRITICAL POC

10.0

CVE-2019-11043 CRITICAL POC

9.8

CVE-2012-1889 HIGH POC

8.8

References

Advisories & patches

ADVISORY https://docs.qualcomm.com/product/publicresources/securitybulletin/october-2024-bulletin.html

Search Externally

GitHub PoC

Exploit-DB PacketStorm Snyk Rapid7 Nuclei Templates Trickest PoC

Back