Medium severity · published Nov 21, 2019
CVE-2019-10535
Improper validation for loop variable received from firmware can lead to out of bound access in WLAN function while iterating through loop in Snapdragon Auto, Snapdragon Compute,…
5.5
CVSS
0.2%
EPSS
No
On KEV
Description
Improper validation for loop variable received from firmware can lead to out of bound access in WLAN function while iterating through loop in Snapdragon Auto, Snapdragon Compute, Snapdragon Consumer Electronics Connectivity, Snapdragon Consumer IOT, Snapdragon Industrial IOT, Snapdragon Mobile, Snapdragon Voice & Music in APQ8053, APQ8096AU, APQ8098, MDM9640, MSM8996AU, MSM8998, QCA6574AU, QCN7605, QCS405, QCS605, SDA845, SDM845, SDX20
CVSS vector
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
Attack vector
Local
Complexity
Low
Privileges
Low
User interaction
None
Confidentiality
None
Integrity
None
Availability
High
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)0.2% · higher than 6% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
AF
Apq8053 Firmware · Qualcomm
All versions, or not specified · source: NVD
AF
Apq8096au Firmware · Qualcomm
All versions, or not specified · source: NVD
AF
Apq8098 Firmware · Qualcomm
All versions, or not specified · source: NVD
MF
Mdm9640 Firmware · Qualcomm
All versions, or not specified · source: NVD
MF
Msm8996au Firmware · Qualcomm
All versions, or not specified · source: NVD
MF
Msm8998 Firmware · Qualcomm
All versions, or not specified · source: NVD
QF
Qca6574au Firmware · Qualcomm
All versions, or not specified · source: NVD
QF
Qcn7605 Firmware · Qualcomm
All versions, or not specified · source: NVD
QF
Qcs405 Firmware · Qualcomm
All versions, or not specified · source: NVD
QF
Qcs605 Firmware · Qualcomm
All versions, or not specified · source: NVD
SF
Sda845 Firmware · Qualcomm
All versions, or not specified · source: NVD
SF
Sdm845 Firmware · Qualcomm
All versions, or not specified · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2019-10535
CVE.org
https://www.cve.org/CVERecord?id=CVE-2019-10535
Patch
https://www.qualcomm.com/company/product-security/bulletins/october-2019-bulletin
More from Apq8053 Firmware
7.8
CVE-2022-22071
Qualcomm Multiple Chipsets Use-After-Free Vulnerability
7.8
CVE-2020-11261
Qualcomm Multiple Chipsets Improper Input Validation Vulnerability
7.8
CVE-2021-1905
Qualcomm Multiple Chipsets Use-After-Free Vulnerability
5.5
CVE-2021-1906
Qualcomm Multiple Chipsets Detection of Error Condition Without Action Vulnerability
9.8
CVE-2022-25687
memory corruption in video due to buffer overflow while parsing asf clips in Snapdragon Auto, Snapdragon Compute, Snapdragon Connectivity, Snapdragon Consumer IOT, Snapdragon…