Critical severity · published Nov 2, 2020
CVE-2020-3703
u'Buffer over-read issue in Bluetooth peripheral firmware due to lack of check for invalid opcode and length of opcode received from central device(This CVE is equivalent to Link…
9.8
CVSS
0.7%
EPSS
No
On KEV
Description
u'Buffer over-read issue in Bluetooth peripheral firmware due to lack of check for invalid opcode and length of opcode received from central device(This CVE is equivalent to Link Layer Length Overfow issue (CVE-2019-16336,CVE-2019-17519) and Silent Length Overflow issue(CVE-2019-17518) mentioned in sweyntooth paper)' in Snapdragon Auto, Snapdragon Compute, Snapdragon Connectivity, Snapdragon Consumer Electronics Connectivity, Snapdragon Consumer IOT, Snapdragon Industrial IOT, Snapdragon IoT, Snapdragon Mobile, Snapdragon Voice & Music in APQ8053, APQ8076, AR9344, Bitra, Kamorta, MDM9206, MDM9207C, MDM9607, MSM8905, MSM8917, MSM8937, MSM8940, MSM8953, Nicobar, QCA6174A, QCA9377, QCM2150, QCM6125, QCS404, QCS405, QCS605, QCS610, QM215, Rennell, SC8180X, SDM429, SDM439, SDM450, SDM630, SDM632, SDM636, SDM660, SDM670, SDM710, SDM845, SDX20, SDX24, SM6150, SM7150, SM8150, SXR1130
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Attack vector
Network
Complexity
Low
Privileges
None
User interaction
None
Confidentiality
High
Integrity
High
Availability
High
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)0.7% · higher than 53% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
AF
Apq8053 Firmware · Qualcomm
All versions, or not specified · source: NVD
AF
Apq8076 Firmware · Qualcomm
All versions, or not specified · source: NVD
AF
Ar9344 Firmware · Qualcomm
All versions, or not specified · source: NVD
BF
Bitra Firmware · Qualcomm
All versions, or not specified · source: NVD
KF
Kamorta Firmware · Qualcomm
All versions, or not specified · source: NVD
MF
Mdm9206 Firmware · Qualcomm
All versions, or not specified · source: NVD
MF
Mdm9207c Firmware · Qualcomm
All versions, or not specified · source: NVD
MF
Mdm9607 Firmware · Qualcomm
All versions, or not specified · source: NVD
MF
Msm8905 Firmware · Qualcomm
All versions, or not specified · source: NVD
MF
Msm8917 Firmware · Qualcomm
All versions, or not specified · source: NVD
MF
Msm8937 Firmware · Qualcomm
All versions, or not specified · source: NVD
MF
Msm8940 Firmware · Qualcomm
All versions, or not specified · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2020-3703
CVE.org
https://www.cve.org/CVERecord?id=CVE-2020-3703
Broken Link
https://www.qualcomm.com/company/product-security/bulletins/october-2020-bulletin
Vendor Advisory
https://www.qualcomm.com/company/product-security/bulletins/october-2020-security-bulletin
More from Apq8053 Firmware
7.8
CVE-2022-22071
Qualcomm Multiple Chipsets Use-After-Free Vulnerability
7.8
CVE-2020-11261
Qualcomm Multiple Chipsets Improper Input Validation Vulnerability
7.8
CVE-2021-1905
Qualcomm Multiple Chipsets Use-After-Free Vulnerability
5.5
CVE-2021-1906
Qualcomm Multiple Chipsets Detection of Error Condition Without Action Vulnerability
9.8
CVE-2022-25687
memory corruption in video due to buffer overflow while parsing asf clips in Snapdragon Auto, Snapdragon Compute, Snapdragon Connectivity, Snapdragon Consumer IOT, Snapdragon…
