#VU107088 Improper Access Control for Register Interface in Qualcomm products - CVE-2024-45556

Vulnerability identifier: #VU107088

Vulnerability risk: Low

CVSSv4.0: 4.3 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:U/U:Clear]

CVE-ID: CVE-2024-45556

CWE-ID: CWE-1262

Exploitation vector: Local

Exploit availability: No

Vulnerable software:
FastConnect 6900
Mobile applications / Mobile firmware & hardware
FastConnect 7800
Mobile applications / Mobile firmware & hardware
Immersive Home 3210 Platform
Mobile applications / Mobile firmware & hardware
Immersive Home 326 Platform
Mobile applications / Mobile firmware & hardware
IPQ5300
Mobile applications / Mobile firmware & hardware
IPQ5302
Mobile applications / Mobile firmware & hardware
IPQ5312
Mobile applications / Mobile firmware & hardware
IPQ5332
Mobile applications / Mobile firmware & hardware
IPQ9008
Mobile applications / Mobile firmware & hardware
IPQ9048
Mobile applications / Mobile firmware & hardware
IPQ9554
Mobile applications / Mobile firmware & hardware
IPQ9570
Mobile applications / Mobile firmware & hardware
IPQ9574
Mobile applications / Mobile firmware & hardware
QCA0000
Mobile applications / Mobile firmware & hardware
QCA8075
Mobile applications / Mobile firmware & hardware
QCA8081
Mobile applications / Mobile firmware & hardware
QCA8082
Mobile applications / Mobile firmware & hardware
QCA8084
Mobile applications / Mobile firmware & hardware
QCA8085
Mobile applications / Mobile firmware & hardware
QCA8386
Mobile applications / Mobile firmware & hardware
QCF8000
Mobile applications / Mobile firmware & hardware
QCF8000SFP
Mobile applications / Mobile firmware & hardware
QCF8001
Mobile applications / Mobile firmware & hardware
QCN5124
Mobile applications / Mobile firmware & hardware
QCN6224
Mobile applications / Mobile firmware & hardware
QCN6402
Mobile applications / Mobile firmware & hardware
QCN6412
Mobile applications / Mobile firmware & hardware
QCN6422
Mobile applications / Mobile firmware & hardware
QCN6432
Mobile applications / Mobile firmware & hardware
QCN9000
Mobile applications / Mobile firmware & hardware
QCN9012
Mobile applications / Mobile firmware & hardware
QCN9013
Mobile applications / Mobile firmware & hardware
QCN9024
Mobile applications / Mobile firmware & hardware
QCN9074
Mobile applications / Mobile firmware & hardware
QCN9160
Mobile applications / Mobile firmware & hardware
QCN9274
Mobile applications / Mobile firmware & hardware
QXM8083
Mobile applications / Mobile firmware & hardware
SD 8 Gen1 5G
Mobile applications / Mobile firmware & hardware
SDX65M
Mobile applications / Mobile firmware & hardware
Snapdragon 429 Mobile Platform
Mobile applications / Mobile firmware & hardware
Snapdragon AR1 Gen 1 Platform
Mobile applications / Mobile firmware & hardware
Snapdragon AR1 Gen 1 Platform "Luna1"
Mobile applications / Mobile firmware & hardware
Snapdragon AR2 Gen 1 Platform
Mobile applications / Mobile firmware & hardware
Snapdragon Wear 4100+ Platform
Mobile applications / Mobile firmware & hardware
Snapdragon X65 5G Modem-RF System
Mobile applications / Mobile firmware & hardware
SSG2115P
Mobile applications / Mobile firmware & hardware
SSG2125P
Mobile applications / Mobile firmware & hardware
SXR1230P
Mobile applications / Mobile firmware & hardware
SXR2230P
Mobile applications / Mobile firmware & hardware
SXR2250P
Mobile applications / Mobile firmware & hardware
WCD9380
Mobile applications / Mobile firmware & hardware
WCD9385
Mobile applications / Mobile firmware & hardware
WCN3620
Mobile applications / Mobile firmware & hardware
WCN3660B
Mobile applications / Mobile firmware & hardware
WCN3680B
Mobile applications / Mobile firmware & hardware
WCN3980
Mobile applications / Mobile firmware & hardware
WSA8830
Mobile applications / Mobile firmware & hardware
WSA8835
Mobile applications / Mobile firmware & hardware
SDM429W
Hardware solutions / Firmware
WSA8832
Hardware solutions / Firmware

Vendor: Qualcomm

Description

The vulnerability allows a local application to gain access to sensitive information.

The vulnerability exists due to improper input validation in TZ Firmware. A local application can gain access to sensitive information.

Mitigation
Install security update from vendor's website.

Vulnerable software versions

FastConnect 6900: All versions

FastConnect 7800: All versions

Immersive Home 3210 Platform: All versions

Immersive Home 326 Platform: All versions

IPQ5300: All versions

IPQ5302: All versions

IPQ5312: All versions

IPQ5332: All versions

IPQ9008: All versions

IPQ9048: All versions

IPQ9554: All versions

IPQ9570: All versions

IPQ9574: All versions

QCA0000: All versions

QCA8075: All versions

QCA8081: All versions

QCA8082: All versions

QCA8084: All versions

QCA8085: All versions

QCA8386: All versions

QCF8000: All versions

QCF8000SFP: All versions

QCF8001: All versions

QCN5124: All versions

QCN6224: All versions

QCN6402: All versions

QCN6412: All versions

QCN6422: All versions

QCN6432: All versions

QCN9000: All versions

QCN9012: All versions

QCN9013: All versions

QCN9024: All versions

QCN9074: All versions

QCN9160: All versions

QCN9274: All versions

QXM8083: All versions

SD 8 Gen1 5G: All versions

SDM429W: All versions

SDX65M: All versions

Snapdragon 429 Mobile Platform: All versions

Snapdragon AR1 Gen 1 Platform: All versions

Snapdragon AR1 Gen 1 Platform "Luna1": All versions

Snapdragon AR2 Gen 1 Platform: All versions

Snapdragon Wear 4100+ Platform: All versions

Snapdragon X65 5G Modem-RF System: All versions

SSG2115P: All versions

SSG2125P: All versions

SXR1230P: All versions

SXR2230P: All versions

SXR2250P: All versions

WCD9380: All versions

WCD9385: All versions

WCN3620: All versions

WCN3660B: All versions

WCN3680B: All versions

WCN3980: All versions

WSA8830: All versions

WSA8832: All versions

WSA8835: All versions

---

External links
https://docs.qualcomm.com/product/publicresources/securitybulletin/april-2025-bulletin.html

---

Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.