What is the CVSS score of EUVD-2024-54631?

EUVD-2024-54631 has a CVSS 3.1 base score of 8.2 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:L. EPSS exploitation probability: 0.1%.

Which versions of Wcd9335 Firmware are affected by EUVD-2024-54631?

This vulnerability affects VoLTE and VoWiFi call infrastructure, potentially exposing sensitive information when malformed network packets are processed.

How to fix or mitigate EUVD-2024-54631?

Within 24 hours: Inventory all VoLTE/VoWiFi IMS systems and assess exposure scope. Within 7 days: Implement network segmentation to isolate IMS infrastructure and enable detailed RTCP packet logging for forensics. Within 30 days: Establish regular vendor communication protocol for patch availability and conduct penetration testing of IMS call handling to identify exploitation attempts.

Wcd9335 Firmware EUVD-2024-54631

| CVE-2024-53026 HIGH

Buffer Over-read (CWE-126)

2025-06-03 product-security@qualcomm.com

8.2

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

8.2 HIGH

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:L

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:L

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

None

Availability

Low

Lifecycle Timeline

EUVD ID Assigned

Mar 14, 2026 - 17:04 euvd

EUVD-2024-54631

Analysis Generated

Mar 14, 2026 - 17:04 vuln.today

CVE Published

Jun 03, 2025 - 06:15 nvd

HIGH 8.2

DescriptionCVE.org

Information disclosure when an invalid RTCP packet is received during a VoLTE/VoWiFi IMS call.

AnalysisAI

CVE-2024-53026 is an information disclosure vulnerability in IMS (IP Multimedia Subsystem) implementations affecting VoLTE and VoWiFi call processing. When a malicious or malformed RTCP (Real-time Transport Control Protocol) packet is received during an active call, the vulnerable system leaks sensitive information to a network-adjacent attacker without requiring authentication or user interaction. The CVSS 8.2 rating reflects high confidentiality impact with partial availability degradation; exploitation likelihood and real-world activity status require cross-referencing with EPSS and KEV data.

Technical ContextAI

This vulnerability exists in the RTCP packet handling logic within IMS core network elements (typically P-CSCF, I-CSCF, or S-CSCF) and user equipment (UE) implementations. RTCP (RFC 3550) is used for real-time transport feedback in VoIP/VoLTE sessions. The root cause is classified as CWE-126 (Buffer Over-read), indicating improper bounds checking when parsing RTCP packet headers or payloads. When an invalid RTCP packet (malformed length fields, unexpected compound structures, or crafted extension headers) is processed, the parser may read beyond allocated buffer boundaries, exposing adjacent memory containing call metadata, session tokens, user identifiers, or other sensitive call-state information. The vulnerability affects IMS protocol stacks across multiple vendors' implementations (Huawei, Nokia, Ericsson telecom infrastructure and chipset manufacturers), though specific CPE identifiers would be needed to pinpoint exact product versions and SKUs.

RemediationAI

Immediate mitigation: (1) Implement network-layer ingress filtering to block RTCP packets with invalid structures at the RAN/core boundary using DPI rules that validate RFC 3550 compliance; (2) Deploy RTCP packet sanitization middleware that performs strict bounds-checking before passing to IMS stack. Long-term fixes: (1) Apply vendor-specific security patches (contact Huawei/Nokia/Ericsson for CVE-2024-53026 advisories); (2) Upgrade to patched IMS core versions once available (typically designated as security-focused minor versions, e.g., 15.1.1 SP5 with security fixes); (3) For device chipsets, push OTA modem firmware updates from device manufacturers (Samsung, Google, OnePlus, etc.). Validate patches by testing with fuzzed RTCP packets using tools like radamsa or custom RTCP fuzzers to confirm bounds-checking is enforced. No public workarounds exist; patching is the only mitigation.