Vulnerability identifier: #VU67821
Vulnerability risk: Low
CVSSv4.0: 4.3 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear]
CVE-ID:
CWE-ID:
CWE-125
Exploitation vector: Local
Exploit availability: No
Vulnerable software:
AQT1000
Mobile applications /
Mobile firmware & hardware
QCA1062
Mobile applications /
Mobile firmware & hardware
QCA1064
Mobile applications /
Mobile firmware & hardware
QCA2062
Mobile applications /
Mobile firmware & hardware
QCA2064
Mobile applications /
Mobile firmware & hardware
QCA2065
Mobile applications /
Mobile firmware & hardware
QCA2066
Mobile applications /
Mobile firmware & hardware
QCA6390
Mobile applications /
Mobile firmware & hardware
QCA6391
Mobile applications /
Mobile firmware & hardware
QCA6420
Mobile applications /
Mobile firmware & hardware
QCA6430
Mobile applications /
Mobile firmware & hardware
SD 8cx Gen2
Mobile applications /
Mobile firmware & hardware
SD 8cx Gen3
Mobile applications /
Mobile firmware & hardware
SD778G
Mobile applications /
Mobile firmware & hardware
SD7c
Mobile applications /
Mobile firmware & hardware
SM6250
Mobile applications /
Mobile firmware & hardware
WCD9340
Mobile applications /
Mobile firmware & hardware
WCD9341
Mobile applications /
Mobile firmware & hardware
WCD9380
Mobile applications /
Mobile firmware & hardware
WCD9385
Mobile applications /
Mobile firmware & hardware
WCN3990
Mobile applications /
Mobile firmware & hardware
WCN3991
Mobile applications /
Mobile firmware & hardware
WCN3998
Mobile applications /
Mobile firmware & hardware
WCN6750
Mobile applications /
Mobile firmware & hardware
WCN6855
Mobile applications /
Mobile firmware & hardware
WCN6856
Mobile applications /
Mobile firmware & hardware
WSA8810
Mobile applications /
Mobile firmware & hardware
WSA8815
Mobile applications /
Mobile firmware & hardware
WSA8830
Mobile applications /
Mobile firmware & hardware
WSA8835
Mobile applications /
Mobile firmware & hardware
SD850
Hardware solutions /
Firmware
Vendor: Qualcomm
Description
The vulnerability allows a local application to perform a denial of service (DoS) attack.
The vulnerability exists due to a boundary condition within the WLAN Windows Host component. A local application can trigger an out-of-bounds read and perform a denial of service (DoS) attack.
Mitigation
Install updates from vendor's website.
Vulnerable software versions
AQT1000: All versions
QCA1062: All versions
QCA1064: All versions
QCA2062: All versions
QCA2064: All versions
QCA2065: All versions
QCA2066: All versions
QCA6390: All versions
QCA6391: All versions
QCA6420: All versions
QCA6430: All versions
SD 8cx Gen2: All versions
SD 8cx Gen3: All versions
SD778G: All versions
SD7c: All versions
SD850: All versions
SM6250: All versions
WCD9340: All versions
WCD9341: All versions
WCD9380: All versions
WCD9385: All versions
WCN3990: All versions
WCN3991: All versions
WCN3998: All versions
WCN6750: All versions
WCN6855: All versions
WCN6856: All versions
WSA8810: All versions
WSA8815: All versions
WSA8830: All versions
WSA8835: All versions
External links
https://docs.qualcomm.com/product/publicresources/securitybulletin/october-2022-bulletin.html
Can this vulnerability be exploited remotely?
No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.
Is there known malware, which exploits this vulnerability?
No. We are not aware of malware exploiting this vulnerability.