High severity · published Apr 7, 2021
CVE-2020-11242
User could gain access to secure memory due to incorrect argument into address range validation api used in SDI to capture requested contents in Snapdragon Industrial IOT,…
7.8
CVSS
0.2%
EPSS
No
On KEV
Description
User could gain access to secure memory due to incorrect argument into address range validation api used in SDI to capture requested contents in Snapdragon Industrial IOT, Snapdragon Mobile
CVSS vector
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Attack vector
Local
Complexity
Low
Privileges
Low
User interaction
None
Confidentiality
High
Integrity
High
Availability
High
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)0.2% · higher than 10% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
PF
Pm660 Firmware · Qualcomm
All versions, or not specified · source: NVD
PF
Pm660a Firmware · Qualcomm
All versions, or not specified · source: NVD
PF
Pm660l Firmware · Qualcomm
All versions, or not specified · source: NVD
PF
Pm855a Firmware · Qualcomm
All versions, or not specified · source: NVD
PF
Pmm855au Firmware · Qualcomm
All versions, or not specified · source: NVD
QF
Qat3514 Firmware · Qualcomm
All versions, or not specified · source: NVD
QF
Qat3522 Firmware · Qualcomm
All versions, or not specified · source: NVD
QF
Qat3550 Firmware · Qualcomm
All versions, or not specified · source: NVD
QF
Qca6564a Firmware · Qualcomm
All versions, or not specified · source: NVD
QF
Qca6564au Firmware · Qualcomm
All versions, or not specified · source: NVD
QF
Qca6574a Firmware · Qualcomm
All versions, or not specified · source: NVD
QF
Qca6574au Firmware · Qualcomm
All versions, or not specified · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2020-11242
CVE.org
https://www.cve.org/CVERecord?id=CVE-2020-11242
Vendor Advisory
https://www.qualcomm.com/company/product-security/bulletins/april-2021-bulletin
More from Pm660 Firmware
7.8
CVE-2020-11261
Qualcomm Multiple Chipsets Improper Input Validation Vulnerability
7.8
CVE-2021-1905
Qualcomm Multiple Chipsets Use-After-Free Vulnerability
5.5
CVE-2021-1906
Qualcomm Multiple Chipsets Detection of Error Condition Without Action Vulnerability
9.8
CVE-2020-11182
Possible heap overflow while parsing NAL header due to lack of check of length of data received from user in Snapdragon Auto, Snapdragon Compute, Snapdragon Connectivity,…
9.8
CVE-2021-1910
Double free in video due to lack of input buffer length check in Snapdragon Auto, Snapdragon Compute, Snapdragon Connectivity, Snapdragon Consumer IOT, Snapdragon Industrial IOT,…