Critical severity · published Jan 21, 2020
CVE-2019-14014
Possible buffer overflow when byte array receives incorrect input from reading source as array is not null terminated in Snapdragon Consumer IOT, Snapdragon Industrial IOT,…
9.8
CVSS
0.9%
EPSS
No
On KEV
Description
Possible buffer overflow when byte array receives incorrect input from reading source as array is not null terminated in Snapdragon Consumer IOT, Snapdragon Industrial IOT, Snapdragon Mobile in Nicobar, SDM670, SDM710, SDM845, SM6150, SM8150, SM8250, SXR2130
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Attack vector
Network
Complexity
Low
Privileges
None
User interaction
None
Confidentiality
High
Integrity
High
Availability
High
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)0.9% · higher than 60% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
NF
Nicobar Firmware · Qualcomm
All versions, or not specified · source: NVD
SF
Sdm670 Firmware · Qualcomm
All versions, or not specified · source: NVD
SF
Sdm710 Firmware · Qualcomm
All versions, or not specified · source: NVD
SF
Sdm845 Firmware · Qualcomm
All versions, or not specified · source: NVD
SF
Sm6150 Firmware · Qualcomm
All versions, or not specified · source: NVD
SF
Sm8150 Firmware · Qualcomm
All versions, or not specified · source: NVD
SF
Sm8250 Firmware · Qualcomm
All versions, or not specified · source: NVD
SF
Sxr2130 Firmware · Qualcomm
All versions, or not specified · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2019-14014
CVE.org
https://www.cve.org/CVERecord?id=CVE-2019-14014
Vendor Advisory
https://www.qualcomm.com/company/product-security/bulletins/january-2020-bulletin
More from Nicobar Firmware
9.8
CVE-2020-3703
u'Buffer over-read issue in Bluetooth peripheral firmware due to lack of check for invalid opcode and length of opcode received from central device(This CVE is equivalent to Link…
9.8
CVE-2020-3692
u'Possible buffer overflow while updating output buffer for IMEI and Gateway Address due to lack of check of input validation for parameters received from server' in Snapdragon…
9.8
CVE-2020-3673
u'Buffer overflow can happen as part of SIP message packet processing while storing values in array due to lack of check to validate the index length' in Snapdragon Auto,…
9.8
CVE-2020-3654
u'Buffer overflow occurs while processing SIP message packet due to lack of check of index validation before copying into it' in Snapdragon Auto, Snapdragon Compute, Snapdragon…
9.8
CVE-2020-3675
u'Potential integer underflow while parsing Service Info and IPv6 link-local TLVs that comes as part of NDPE attribute' in Snapdragon Auto, Snapdragon Compute, Snapdragon…