High severity · published Jun 22, 2020
CVE-2020-3626
Any application can bind to it and exercise the APIs due to no protection for AIDL uimlpaservice in Snapdragon Auto, Snapdragon Compute, Snapdragon Consumer IOT, Snapdragon…
7.8
CVSS
0.2%
EPSS
No
On KEV
Description
Any application can bind to it and exercise the APIs due to no protection for AIDL uimlpaservice in Snapdragon Auto, Snapdragon Compute, Snapdragon Consumer IOT, Snapdragon Industrial IOT, Snapdragon Mobile, Snapdragon Wearables in APQ8053, APQ8096AU, APQ8098, MSM8905, MSM8909W, MSM8917, MSM8920, MSM8937, MSM8940, MSM8953, MSM8996AU, MSM8998, Nicobar, QCA6574AU, QCS605, QM215, Rennell, Saipan, SDA660, SDM429, SDM429W, SDM439, SDM450, SDM630, SDM632, SDM636, SDM660, SDM670, SDM710, SDM845, SM6150, SM7150, SM8150, SM8250, SXR1130, SXR2130
CVSS vector
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Attack vector
Local
Complexity
Low
Privileges
Low
User interaction
None
Confidentiality
High
Integrity
High
Availability
High
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)0.2% · higher than 6% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
AF
Apq8053 Firmware · Qualcomm
All versions, or not specified · source: NVD
AF
Apq8096au Firmware · Qualcomm
All versions, or not specified · source: NVD
AF
Apq8098 Firmware · Qualcomm
All versions, or not specified · source: NVD
MF
Msm8905 Firmware · Qualcomm
All versions, or not specified · source: NVD
MF
Msm8909w Firmware · Qualcomm
All versions, or not specified · source: NVD
MF
Msm8917 Firmware · Qualcomm
All versions, or not specified · source: NVD
MF
Msm8920 Firmware · Qualcomm
All versions, or not specified · source: NVD
MF
Msm8937 Firmware · Qualcomm
All versions, or not specified · source: NVD
MF
Msm8940 Firmware · Qualcomm
All versions, or not specified · source: NVD
MF
Msm8953 Firmware · Qualcomm
All versions, or not specified · source: NVD
MF
Msm8996au Firmware · Qualcomm
All versions, or not specified · source: NVD
MF
Msm8998 Firmware · Qualcomm
All versions, or not specified · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2020-3626
CVE.org
https://www.cve.org/CVERecord?id=CVE-2020-3626
Broken Link
https://www.qualcomm.com/company/product-security/bulletins/june-2020-bulletin
Vendor Advisory
https://www.qualcomm.com/company/product-security/bulletins/june-2020-security-bulletin
More from Apq8053 Firmware
7.8
CVE-2022-22071
Qualcomm Multiple Chipsets Use-After-Free Vulnerability
7.8
CVE-2020-11261
Qualcomm Multiple Chipsets Improper Input Validation Vulnerability
7.8
CVE-2021-1905
Qualcomm Multiple Chipsets Use-After-Free Vulnerability
5.5
CVE-2021-1906
Qualcomm Multiple Chipsets Detection of Error Condition Without Action Vulnerability
9.8
CVE-2022-25687
memory corruption in video due to buffer overflow while parsing asf clips in Snapdragon Auto, Snapdragon Compute, Snapdragon Connectivity, Snapdragon Consumer IOT, Snapdragon…