Critical severity · published Jun 9, 2021
CVE-2020-11176
While processing server certificate from IPSec server, certificate validation for subject alternative name API can cause heap overflow which can lead to memory corruption in…
9.8
CVSS
0.7%
EPSS
No
On KEV
Description
While processing server certificate from IPSec server, certificate validation for subject alternative name API can cause heap overflow which can lead to memory corruption in Snapdragon Auto, Snapdragon Compute, Snapdragon Connectivity, Snapdragon Consumer IOT, Snapdragon Industrial IOT, Snapdragon IoT, Snapdragon Mobile
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Attack vector
Network
Complexity
Low
Privileges
None
User interaction
None
Confidentiality
High
Integrity
High
Availability
High
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)0.7% · higher than 52% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
AF
Apq8017 Firmware · Qualcomm
All versions, or not specified · source: NVD
AF
Apq8053 Firmware · Qualcomm
All versions, or not specified · source: NVD
AF
Aqt1000 Firmware · Qualcomm
All versions, or not specified · source: NVD
AF
Ar8035 Firmware · Qualcomm
All versions, or not specified · source: NVD
CF
Csrb31024 Firmware · Qualcomm
All versions, or not specified · source: NVD
MF
Msm8917 Firmware · Qualcomm
All versions, or not specified · source: NVD
MF
Msm8920 Firmware · Qualcomm
All versions, or not specified · source: NVD
MF
Msm8940 Firmware · Qualcomm
All versions, or not specified · source: NVD
MF
Msm8953 Firmware · Qualcomm
All versions, or not specified · source: NVD
MF
Msm8976 Firmware · Qualcomm
All versions, or not specified · source: NVD
MF
Msm8976sg Firmware · Qualcomm
All versions, or not specified · source: NVD
QF
Qca6174a Firmware · Qualcomm
All versions, or not specified · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2020-11176
CVE.org
https://www.cve.org/CVERecord?id=CVE-2020-11176
Vendor Advisory
https://www.qualcomm.com/company/product-security/bulletins/june-2021-bulletin
More from Apq8017 Firmware
7.8
CVE-2023-33107
Integer Overflow or Wraparound in Graphics Linux
7.8
CVE-2023-33063
Use After Free in DSP Services
7.8
CVE-2020-11261
Qualcomm Multiple Chipsets Improper Input Validation Vulnerability
7.8
CVE-2021-1905
Qualcomm Multiple Chipsets Use-After-Free Vulnerability
5.5
CVE-2021-1906
Qualcomm Multiple Chipsets Detection of Error Condition Without Action Vulnerability