High severity · published Apr 16, 2020
CVE-2019-10623
Possible integer overflow can happen in host driver while processing user controlled string due to improper validation on data received
7.1
CVSS
0.2%
EPSS
No
On KEV
Description
Possible integer overflow can happen in host driver while processing user controlled string due to improper validation on data received. in Snapdragon Auto, Snapdragon Compute, Snapdragon Consumer Electronics Connectivity, Snapdragon Consumer IOT, Snapdragon Industrial IOT, Snapdragon Mobile in QCN7605, QCS605, Rennell, SC8180X, SDA845, SDM710, SDX24, SDX55, SM7150, SM8150, SM8250, SXR2130
CVSS vector
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H
Attack vector
Local
Complexity
Low
Privileges
Low
User interaction
None
Confidentiality
High
Integrity
None
Availability
High
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)0.2% · higher than 8% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
QF
Qcn7605 Firmware · Qualcomm
All versions, or not specified · source: NVD
QF
Qcs605 Firmware · Qualcomm
All versions, or not specified · source: NVD
RF
Rennell Firmware · Qualcomm
All versions, or not specified · source: NVD
SF
Sc8180x Firmware · Qualcomm
All versions, or not specified · source: NVD
SF
Sda845 Firmware · Qualcomm
All versions, or not specified · source: NVD
SF
Sdm710 Firmware · Qualcomm
All versions, or not specified · source: NVD
SF
Sdx24 Firmware · Qualcomm
All versions, or not specified · source: NVD
SF
Sdx55 Firmware · Qualcomm
All versions, or not specified · source: NVD
SF
Sm7150 Firmware · Qualcomm
All versions, or not specified · source: NVD
SF
Sm8150 Firmware · Qualcomm
All versions, or not specified · source: NVD
SF
Sm8250 Firmware · Qualcomm
All versions, or not specified · source: NVD
SF
Sxr2130 Firmware · Qualcomm
All versions, or not specified · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2019-10623
CVE.org
https://www.cve.org/CVERecord?id=CVE-2019-10623
Patch
https://www.qualcomm.com/company/product-security/bulletins/april-2020-bulletin
More from Qcn7605 Firmware
9.8
CVE-2021-35081
Possible buffer overflow due to improper validation of SSID length received from beacon or probe response during an IBSS session in Snapdragon Auto, Snapdragon Compute, Snapdragon…
9.8
CVE-2020-11153
u'Out of bound memory access while processing GATT data received due to lack of check of pdu data length and leads to remote code execution' in Snapdragon Auto, Snapdragon…
9.8
CVE-2020-3675
u'Potential integer underflow while parsing Service Info and IPv6 link-local TLVs that comes as part of NDPE attribute' in Snapdragon Auto, Snapdragon Compute, Snapdragon…
9.8
CVE-2020-3669
u'Buffer Overflow issue in WLAN tcp ip verification due to usage of out of range pointer offset' in Snapdragon Auto, Snapdragon Compute, Snapdragon Connectivity, Snapdragon…
9.8
CVE-2020-3668
u'Buffer overflow while parsing PMF enabled MCBC frames due to frame length being lesser than what is expected while parsing' in Snapdragon Auto, Snapdragon Compute, Snapdragon…