High severity · published Oct 26, 2018
CVE-2018-11849
Lack of check on out of range of bssid parameter When processing scan start command will lead to buffer flow in Snapdragon Automobile, Snapdragon Mobile, Snapdragon Wear in…
7.8
CVSS
0.2%
EPSS
No
On KEV
Description
Lack of check on out of range of bssid parameter When processing scan start command will lead to buffer flow in Snapdragon Automobile, Snapdragon Mobile, Snapdragon Wear in version IPQ8074, MDM9206, MDM9607, MDM9635M, MDM9640, MDM9650, MSM8996AU, QCA4531, QCA6174A, QCA6564, QCA6574, QCA6574AU, QCA6584, QCA6584AU, QCA9377, QCA9378, QCA9379, QCA9886, SD 210/SD 212/SD 205, SD 425, SD 427, SD 430, SD 435, SD 450, SD 600, SD 625, SD 650/52, SD 810, SD 820, SD 820A, SD 835, SD 845, SD 850, SDA660, SDM630, SDM632, SDM636, SDM660, SDM710, SDX20, Snapdragon_High_Med_2016
CVSS vector
CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Attack vector
Local
Complexity
Low
Privileges
Low
User interaction
None
Confidentiality
High
Integrity
High
Availability
High
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)0.2% · higher than 15% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
IF
Ipq8074 Firmware · Qualcomm
All versions, or not specified · source: NVD
MF
Mdm9206 Firmware · Qualcomm
All versions, or not specified · source: NVD
MF
Mdm9607 Firmware · Qualcomm
All versions, or not specified · source: NVD
MF
Mdm9635m Firmware · Qualcomm
All versions, or not specified · source: NVD
MF
Mdm9640 Firmware · Qualcomm
All versions, or not specified · source: NVD
MF
Mdm9650 Firmware · Qualcomm
All versions, or not specified · source: NVD
MF
Msm8996au Firmware · Qualcomm
All versions, or not specified · source: NVD
QF
Qca4531 Firmware · Qualcomm
All versions, or not specified · source: NVD
QF
Qca6174a Firmware · Qualcomm
All versions, or not specified · source: NVD
QF
Qca6564 Firmware · Qualcomm
All versions, or not specified · source: NVD
QF
Qca6574 Firmware · Qualcomm
All versions, or not specified · source: NVD
QF
Qca6574au Firmware · Qualcomm
All versions, or not specified · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2018-11849
CVE.org
https://www.cve.org/CVERecord?id=CVE-2018-11849
Third Party Advisory
http://www.securityfocus.com/bid/107681
Vendor Advisory
https://www.qualcomm.com/company/product-security/bulletins
More from Ipq8074 Firmware
9.8
CVE-2024-21473
Memory corruption while redirecting log file to any file location with any file name
9.8
CVE-2022-25748
Memory corruption in WLAN due to integer overflow to buffer overflow while parsing GTK frames
9.8
CVE-2021-35104
Possible buffer overflow due to improper parsing of headers while playing the FLAC audio clip in Snapdragon Auto, Snapdragon Compute, Snapdragon Connectivity, Snapdragon Consumer…
9.8
CVE-2021-30351
An out of bound memory access can occur due to improper validation of number of frames being passed during music playback in Snapdragon Auto, Snapdragon Compute, Snapdragon…
9.8
CVE-2021-1976
A use after free can occur due to improper validation of P2P device address in PD Request frame in Snapdragon Auto, Snapdragon Compute, Snapdragon Connectivity, Snapdragon…