Critical severity · published Sep 30, 2019
CVE-2019-10539
Possible buffer overflow issue due to lack of length check when parsing the extended cap IE header length in Snapdragon Auto, Snapdragon Compute, Snapdragon Consumer Electronics…
9.8
CVSS
0.9%
EPSS
No
On KEV
Description
Possible buffer overflow issue due to lack of length check when parsing the extended cap IE header length in Snapdragon Auto, Snapdragon Compute, Snapdragon Consumer Electronics Connectivity, Snapdragon Consumer IOT, Snapdragon Industrial IOT, Snapdragon Mobile, Snapdragon Voice & Music, Snapdragon Wired Infrastructure and Networking in IPQ8074, MDM9206, MDM9607, MDM9640, MDM9650, MSM8996AU, QCA6174A, QCA6574, QCA6574AU, QCA6584, QCA8081, QCA9379, QCS404, QCS405, QCS605, Qualcomm 215, SD 210/SD 212/SD 205, SD 425, SD 427, SD 430, SD 435, SD 439 / SD 429, SD 450, SD 625, SD 632, SD 636, SD 665, SD 675, SD 712 / SD 710 / SD 670, SD 730, SD 820, SD 820A, SD 835, SD 845 / SD 850, SD 855, SD 8CX, SDA660, SDM439, SDM630, SDM660, SDX20, SDX24, SXR1130
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Attack vector
Network
Complexity
Low
Privileges
None
User interaction
None
Confidentiality
High
Integrity
High
Availability
High
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)0.9% · higher than 60% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
IF
Ipq8074 Firmware · Qualcomm
All versions, or not specified · source: NVD
MF
Mdm9206 Firmware · Qualcomm
All versions, or not specified · source: NVD
MF
Mdm9607 Firmware · Qualcomm
All versions, or not specified · source: NVD
MF
Mdm9640 Firmware · Qualcomm
All versions, or not specified · source: NVD
MF
Mdm9650 Firmware · Qualcomm
All versions, or not specified · source: NVD
MF
Msm8996au Firmware · Qualcomm
All versions, or not specified · source: NVD
QF
Qca6174a Firmware · Qualcomm
All versions, or not specified · source: NVD
QF
Qca6574 Firmware · Qualcomm
All versions, or not specified · source: NVD
QF
Qca6574au Firmware · Qualcomm
All versions, or not specified · source: NVD
QF
Qca6584 Firmware · Qualcomm
All versions, or not specified · source: NVD
QF
Qca8081 Firmware · Qualcomm
All versions, or not specified · source: NVD
QF
Qca9379 Firmware · Qualcomm
All versions, or not specified · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2019-10539
CVE.org
https://www.cve.org/CVERecord?id=CVE-2019-10539
Vendor Advisory
https://www.qualcomm.com/company/product-security/bulletins
More from Ipq8074 Firmware
9.8
CVE-2024-21473
Memory corruption while redirecting log file to any file location with any file name
9.8
CVE-2022-25748
Memory corruption in WLAN due to integer overflow to buffer overflow while parsing GTK frames
9.8
CVE-2021-35104
Possible buffer overflow due to improper parsing of headers while playing the FLAC audio clip in Snapdragon Auto, Snapdragon Compute, Snapdragon Connectivity, Snapdragon Consumer…
9.8
CVE-2021-30351
An out of bound memory access can occur due to improper validation of number of frames being passed during music playback in Snapdragon Auto, Snapdragon Compute, Snapdragon…
9.8
CVE-2021-1976
A use after free can occur due to improper validation of P2P device address in PD Request frame in Snapdragon Auto, Snapdragon Compute, Snapdragon Connectivity, Snapdragon…