#VU95343 Reachable Assertion in Qualcomm products - CVE-2024-23350

Vulnerability identifier: #VU95343

Vulnerability risk: Medium

CVSSv4.0: 4.9 [CVSS:4.0/AV:A/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Green]

CVE-ID: CVE-2024-23350

CWE-ID: CWE-617

Exploitation vector: Local network

Exploit availability: No

Vulnerable software:
AR8035
Mobile applications / Mobile firmware & hardware
FastConnect 6900
Mobile applications / Mobile firmware & hardware
FastConnect 7800
Mobile applications / Mobile firmware & hardware
QCA6584AU
Mobile applications / Mobile firmware & hardware
QCA6698AQ
Mobile applications / Mobile firmware & hardware
QCA8081
Mobile applications / Mobile firmware & hardware
QCA8337
Mobile applications / Mobile firmware & hardware
QCC710
Mobile applications / Mobile firmware & hardware
QCN6224
Mobile applications / Mobile firmware & hardware
QCN6274
Mobile applications / Mobile firmware & hardware
QEP8111
Mobile applications / Mobile firmware & hardware
QFW7114
Mobile applications / Mobile firmware & hardware
QFW7124
Mobile applications / Mobile firmware & hardware
Snapdragon 8 Gen 3 Mobile Platform
Mobile applications / Mobile firmware & hardware
Snapdragon Auto 5G Modem-RF Gen 2
Mobile applications / Mobile firmware & hardware
Snapdragon X35 5G Modem-RF System
Mobile applications / Mobile firmware & hardware
Snapdragon X72 5G Modem-RF System
Mobile applications / Mobile firmware & hardware
Snapdragon X75 5G Modem-RF System
Mobile applications / Mobile firmware & hardware
WCD9340
Mobile applications / Mobile firmware & hardware
WCD9390
Mobile applications / Mobile firmware & hardware
WCD9395
Mobile applications / Mobile firmware & hardware
WSA8840
Mobile applications / Mobile firmware & hardware
WSA8845
Mobile applications / Mobile firmware & hardware
WSA8845H
Mobile applications / Mobile firmware & hardware
QCA6174A
Hardware solutions / Firmware

Vendor: Qualcomm

Description

The vulnerability allows a remote attacker to perform a denial of service (DoS) attack.

The vulnerability exists due to improper input validation in Multi Mode Call Processor. A remote attacker can perform a denial of service (DoS) attack.

Mitigation
Install security update from vendor's website.

Vulnerable software versions

AR8035: All versions

FastConnect 6900: All versions

FastConnect 7800: All versions

QCA6174A: All versions

QCA6584AU: All versions

QCA6698AQ: All versions

QCA8081: All versions

QCA8337: All versions

QCC710: All versions

QCN6224: All versions

QCN6274: All versions

QEP8111: All versions

QFW7114: All versions

QFW7124: All versions

Snapdragon 8 Gen 3 Mobile Platform: All versions

Snapdragon Auto 5G Modem-RF Gen 2: All versions

Snapdragon X35 5G Modem-RF System: All versions

Snapdragon X72 5G Modem-RF System: All versions

Snapdragon X75 5G Modem-RF System: All versions

WCD9340: All versions

WCD9390: All versions

WCD9395: All versions

WSA8840: All versions

WSA8845: All versions

WSA8845H: All versions

---

External links
https://docs.qualcomm.com/product/publicresources/securitybulletin/august-2024-bulletin.html

---

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the local network (LAN).

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.