Medium severity · published Nov 12, 2020
CVE-2020-11209
Improper authorization in DSP process could allow unauthorized users to downgrade the library versions in SD820, SD821, SD820, QCS603, QCS605, SDA855, SA6155P, SA6145P, SA6155,…
5.5
CVSS
1.6%
EPSS
No
On KEV
Description
Improper authorization in DSP process could allow unauthorized users to downgrade the library versions in SD820, SD821, SD820, QCS603, QCS605, SDA855, SA6155P, SA6145P, SA6155, SA6155P, SD855, SD 675, SD660, SD429, SD439
CVSS vector
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N
Attack vector
Local
Complexity
Low
Privileges
Low
User interaction
None
Confidentiality
None
Integrity
High
Availability
None
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)1.6% · higher than 75% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
QF
Qcs603 Firmware · Qualcomm
All versions, or not specified · source: NVD
QF
Qcs605 Firmware · Qualcomm
All versions, or not specified · source: NVD
S6
SD 675 Firmware · Qualcomm
All versions, or not specified · source: NVD
SF
Sa6145p Firmware · Qualcomm
All versions, or not specified · source: NVD
SF
Sa6155 Firmware · Qualcomm
All versions, or not specified · source: NVD
SF
Sa6155p Firmware · Qualcomm
All versions, or not specified · source: NVD
SF
Sd429 Firmware · Qualcomm
All versions, or not specified · source: NVD
SF
Sd439 Firmware · Qualcomm
All versions, or not specified · source: NVD
SF
Sd660 Firmware · Qualcomm
All versions, or not specified · source: NVD
SF
Sd820 Firmware · Qualcomm
All versions, or not specified · source: NVD
SF
Sd821 Firmware · Qualcomm
All versions, or not specified · source: NVD
SF
Sd855 Firmware · Qualcomm
All versions, or not specified · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2020-11209
CVE.org
https://www.cve.org/CVERecord?id=CVE-2020-11209
Third Party Advisory
https://blog.checkpoint.com/2020/08/06/achilles-small-chip-big-peril/
Exploit
https://research.checkpoint.com/2021/pwn2own-qualcomm-dsp/
Broken Link
https://www.qualcomm.com/company/product-security/bulletins/november-2020-bulletin
More from Qcs603 Firmware
9.8
CVE-2022-25668
Memory corruption in video driver due to double free while parsing ASF clip in Snapdragon Auto, Snapdragon Compute, Snapdragon Connectivity, Snapdragon Consumer IOT, Snapdragon…
9.8
CVE-2022-25659
Memory corruption due to buffer overflow while parsing MKV clips with invalid bitmap size in Snapdragon Auto, Snapdragon Compute, Snapdragon Connectivity, Snapdragon Consumer IOT,…
9.8
CVE-2022-25658
Memory corruption due to incorrect pointer arithmetic when attempting to change the endianness in video parser function in Snapdragon Auto, Snapdragon Compute, Snapdragon…
9.8
CVE-2022-22087
memory corruption in video due to buffer overflow while parsing mkv clip with no codechecker in Snapdragon Auto, Snapdragon Compute, Snapdragon Connectivity, Snapdragon Consumer…
9.8
CVE-2022-22086
Memory corruption in video due to double free while parsing 3gp clip with invalid meta data atoms in Snapdragon Auto, Snapdragon Compute, Snapdragon Connectivity, Snapdragon…