mdm9207c firmware · threatengine.sh

Home/Product/qualcomm mdm9207c firmware

Product

qualcomm mdm9207c firmware

118 known vulnerabilities across versions

Vulnerabilities are listed by affected version. Select any CVE for the full briefing and its intelligence graph.

Sort Min CVSS Published since

u'Buffer over-read issue in Bluetooth peripheral firmware due to lack of check for invalid opcode and length of opcode received fr

u'Use after free while installing new security rule in ipcrtr as old one is deleted and this rule could still be in use for checki

u'Remote code execution can happen by sending a carefully crafted POST query when Device configuration is accessed from a tethered

u'Out of bounds memory access during memory copy while processing Host command' in Snapdragon Auto, Snapdragon Compute, Snapdragon

u'A potential buffer overflow exists due to integer overflow when parsing handler options due to wrong data type usage in operatio

u'Information exposure issues while processing IE header due to improper check of beacon IE frame' in Snapdragon Auto, Snapdragon

u'Possible out of bound write while processing association response received from host due to lack of check of IE length' in Snapd

u'Buffer over read occurs while processing information element from beacon due to lack of check of data received from beacon' in S

u'Heap overflow in diag command handler due to lack of check of packet length received from user' in Snapdragon Auto, Snapdragon C

u'SMEM partition can be manipulated in case of any compromise on HLOS, thus resulting in access to memory outside of SMEM address

Possible out of bound access while processing assoc response from host due to improper length check before copying into buffer in

Out of bound write while QoS DSCP mapping due to improper input validation for data received from association response frame in Sn

Possible buffer overflow while parsing mp4 clip with corrupted sample atoms due to improper validation of index in Snapdragon Auto

Register write via debugfs is disabled by default to prevent register writing via debugfs. in Snapdragon Auto, Snapdragon Compute,

Device misbehavior may be observed when incorrect offset, length or number of buffers is passed by user space in Snapdragon Auto,

Array out of bound access can occur in display module due to lack of bound check on input parcel received in Snapdragon Auto, Snap

Close and bind operations done on a socket can lead to a Use-After-Free condition. in Snapdragon Auto, Snapdragon Compute, Snapdra

A possible buffer overflow would occur while processing command from firmware due to the group_id obtained from the firmware being

Buffer over-write may occur during fetching track decoder specific information if cb size exceeds buffer size in Snapdragon Auto,

Buffer overflow will happen while parsing mp4 clip with corrupted sample atoms values which exceeds MAX_UINT32 range due to lack o

Possible null-pointer dereference can occur while parsing mp4 clip with corrupted sample table atoms in Snapdragon Auto, Snapdrago

Possible null-pointer dereference can occur while parsing mp4 clip with corrupted sample table atoms in Snapdragon Auto, Snapdrago

Possible buffer overflow while copying the frame to local buffer due to lack of check of length before copying in Snapdragon Auto,

Integer overflow in diag command handler when user inputs a large value for number of tasks field in the request packet in Snapdra

System Services exports services without permission protect and can lead to information exposure in Snapdragon Industrial IOT, Sna

Copying RTCP messages into the output buffer without checking the destination buffer size which could lead to a remote stack overf

Buffer overflows while decoding setup message from Network due to lack of check of IE message length received from network in Snap

Payload size is not validated before reading memory that may cause issue of accessing invalid pointer or some garbage data in Snap

Integer overflow may occur if atom size is less than atom offset as there is improper validation of atom size in Snapdragon Auto,

Array out of bound may occur while playing mp3 file as no check is there on offset if it is greater than the buffer allocated or n

Possibility of out of bound access while processing the responses from video firmware in Snapdragon Auto, Snapdragon Compute, Snap

Buffer overflow in display function due to memory copy without checking length of size using strcpy function in Snapdragon Auto, S

Valid deauth/disassoc frames is dropped in case if RMF is enabled and some rouge peer keep on sending rogue deauth/disassoc frames

When attempting to create a new XFRM policy, a stack out-of-bounds read will occur if the user provides a template where the mode

Out of bound read in adm call back function due to incorrect boundary check for payload in command response in Snapdragon Auto, Sn

Buffer over-read in ADSP parse function due to lack of check for availability of sufficient data payload received in command respo

Active command timeout since WM status change cmd is not removed from active queue if peer sends multiple deauth frames. in Snapdr

Possible integer overflow to buffer overflow in WLAN while parsing nonstandard NAN IE messages. in Snapdragon Auto, Snapdragon Com

Possible buffer overflow while playing mkv clip due to lack of validation of atom size buffer in Snapdragon Auto, Snapdragon Compu

Buffer overflow in WLAN firmware while parsing GTK IE containing GTK key having length more than the buffer size in Snapdragon Aut

Buffer overflow can occur in WLAN firmware while unwraping data using CCMP cipher suite during parsing of EAPOL handshake frame

Buffer overflow can occur in function wlan firmware while copying association frame content if frame length is more than the maxim

Possible use after free issue in pcm volume controls due to race condition exist in private data used in mixer controls in Snapdra

Multiple Read overflows issue due to improper length check while decoding RAU accept/PDN disconnect Rej/Modify EPS ctxt req/bearer

Multiple Read overflows issue due to improper length check while decoding 3G attach accept/ SMS/ pdn connection reject/ esm data t

Wrong public key usage from existing oem_keystore for hash generation in Snapdragon Auto, Snapdragon Consumer IOT, Snapdragon Indu

Out of bound access in diag services when DCI command buffer reallocation is not done properly with required capacity in Snapdrago

Out of bound memory access can happen while parsing ADSP message due to lack of check of size of payload received from userspace i

Lack of boundary checks for data offsets received from HLOS can lead to out-of-bound read in Snapdragon Auto, Snapdragon Compute,

When issuing IOCTL calls to ION, Memory leak can occur due to failure in unassign pages under certain conditions in Snapdragon Aut

Side channel issue in QTEE due to usage of non-time-constant comparison function such as memcmp or strcmp in Snapdragon Auto, Snap

Possible buffer overflow in WLAN handler due to lack of validation of destination buffer size before copying it in Snapdragon Auto

Possible buffer overflow in WLAN handler due to lack of validation of destination buffer size before copying into it in Snapdragon

Possible buffer overflow in data offload handler due to lack of check of keydata length when copying data in Snapdragon Auto, Snap

Buffer overflow occurs while processing LMP packet in which name length parameter exceeds value specified in BT-specification in S

Potential buffer over-read due to lack of bound check of memory offset passed in WLAN firmware in Snapdragon Compute, Snapdragon C

Null-pointer dereference can occur while accessing the segment element info when it is not allocated and assigned in Snapdragon Au

Memory use after free issue in audio due to lack of resource control in Snapdragon Auto, Snapdragon Compute, Snapdragon Consumer I

Buffer overflow can occur while parsing RSN IE containing list of PMK ID`s which are more than the buffer size in Snapdragon Auto,

Buffer overwrite during memcpy due to lack of check on SSID length validation in Snapdragon Auto, Snapdragon Compute, Snapdragon C

Possible buffer overflow in WLAN WMI handler due to lack of ssid length check when copying data in Snapdragon Auto, Snapdragon Com

Use after free issue occurs If the real device interface goes down and a route lookup is performed while sending a raw IPv6 messag

Null pointer dereference can happen when parsing udta atom which is non-standard and having invalid depth in Snapdragon Auto, Snap

Out of bound write in WLAN driver due to NULL character not properly placed after SSID name in Snapdragon Auto, Snapdragon Compute

Possible use after free issue while CRM is accessing the link pointer from device private data due to lack of resource protection

Uninitialized stack data gets used If memory is not allocated for blob or if the allocated blob is less than the struct size requi

Buffer Over read of codec private data while parsing an mkv file due to lack of check of buffer size before read in Snapdragon Aut

Possibility of use-after-free and double free because of not marking buffer as NULL after freeing can lead to dangling pointer acc

Stage-2 fault will occur while writing to an ION system allocation which has been assigned to non-HLOS memory which is non-standar

During listener modified response processing, a buffer overrun occurs due to lack of buffer size verification when updating messag

Using memory after being freed in qsee due to wrong implementation can lead to unexpected behavior such as execution of unknown co

Out of bound access while parsing dts atom, which is non-standard as it does not have valid number of tracks in Snapdragon Auto, S

There is a way to deceive the GPU kernel driver into thinking there is room in the GPU ringbuffer and overwriting existing command

Heap buffer overflow can occur while parsing invalid MKV clip which is not standard and have invalid vorbis codec data in Snapdrag

Integer overflow occurs while playing the clip which is nonstandard in Snapdragon Auto, Snapdragon Compute, Snapdragon Connectivit

While parsing invalid super index table, elements within super index table may exceed total chunk size and invalid data is read in

Buffer overflow occur while playing the clip which is nonstandard due to lack of offset length check in Snapdragon Auto, Snapdrago

Buffer overflow occur while playing the clip which is nonstandard due to lack of check of size duration in Snapdragon Auto, Snapdr

Buffer overflow occurs while processing invalid MKV clip, which has invalid EBML size in Snapdragon Auto, Snapdragon Compute, Snap

Null pointer exception can happen while parsing invalid MKV clip where cue information is parsed before segment information in Sna

Buffer overflow can occur while processing clip due to lack of check of object size before parsing in Snapdragon Auto, Snapdragon

Potential use-after-free heap error during Validate/Present calls on display HW composer in Snapdragon Auto, Snapdragon Compute, S

NULL is assigned to local instance of audio device pointer after free instead of global static pointer and can lead to use after f

Buffer over-read can occur while playing the video clip which is not standard in Snapdragon Auto, Snapdragon Compute, Snapdragon C

Null pointer dereference can occur while parsing the clip which is nonstandard in Snapdragon Auto, Snapdragon Compute, Snapdragon

While transferring data from APPS to DSP, Out of bound in FastRPC HLOS Driver due to the data buffer which can be controlled by DS

Null-pointer dereference issue can occur while calculating string length when source string length is zero in Snapdragon Auto, Sna

Out of boundary access is possible as there is no validation of data accessed against the received size of the packet in case of m

Out of bounds memcpy can occur by providing the embedded NULL character string and length greater than the actual string length in

Use of local variable as argument to netlink CB callback goes out of it scope when callback triggered lead to invalid stack memory

Possible buffer overwrite in message handler due to lack of validation of tid value calculated from packets received from firmware

Possibility of out of bound access in debug queue, if packet size field is corrupted in Snapdragon Auto, Snapdragon Compute, Snapd

Improper check in video driver while processing data from video firmware can lead to integer overflow and then buffer overflow in

Out-of-bound read in the wireless driver in the Linux kernel due to lack of check of buffer length. in Snapdragon Auto, Snapdragon

Improper length check on source buffer to handle userspace data received can lead to out-of-bound access in diag handlers in Snapd

Potential double free scenario if driver receives another DIAG_EVENT_LOG_SUPPORTED event from firmware as the pointer is not set t

Use after free of a pointer in iWLAN scenario during netmgr state transition to CONNECT in Snapdragon Auto, Snapdragon Compute, Sn

Memory is being freed up twice when two concurrent threads are executing in parallel in Snapdragon Auto, Snapdragon Compute, Snapd

Possibility of Null pointer access if the SPDM commands are executed in the non-standard way in Trustzone in Snapdragon Auto, Snap

Out of bound write can happen in WMI firmware event handler due to lack of validation of data received from WLAN firmware in Snapd

When a fake broadcast/multicast 11w rmf without mmie received, since no proper length check in wma_process_bip, buffer overflow wi

Incorrect length used while validating the qsee log buffer sent from HLOS which could then lead to remap conflict in Snapdragon Au

Out of bound read would occur while trying to read action category and action ID without validating the action length of the Rx Fr

Possible integer overflow while multiplying two integers of 32 bit in QDCM API of get display modes as there is no check on the ma

Snapshot of IB can lead to invalid address access due to missing check for size in the related function in Snapdragon Auto, Snapdr

Accessing data buffer beyond the available data while parsing ogg clip can lead to null-pointer dereference and then memory corrup

Buffer overflow can occur due to usage of wrong datatype and missing length check before copying into buffer in Snapdragon Auto, S

Race condition between the camera functions due to lack of resource lock which will lead to memory corruption and UAF issue in Sna

Position determination accuracy may be degraded due to wrongly decoded information in Snapdragon Auto, Snapdragon Compute, Snapdra

Buffer overflow can occur while processing non-standard NAN message from user space. in Snapdragon Auto, Snapdragon Consumer Elect

Possible OOB read issue in P2P action frames while handling WLAN management frame in Snapdragon Auto, Snapdragon Consumer Electron

Possible double free issue in kernel while handling the camera sensor and its sub modules power sequence in Snapdragon Auto, Snapd

Buffer overflow can occur in wlan module if supported rates or extended rates element length is greater than max rate set length i

Out-of-bounds access can occur in camera driver due to improper validation of array index in Snapdragon Auto, Snapdragon Consumer

Use after free issue in Xtra daemon shutdown due to static object instance getting freed from a multiple places in Snapdragon Auto

Race condition due to the lack of resource lock which will be concurrently modified in the memcpy statement leads to out of bound

While processing vendor command which contains corrupted channel count, an integer overflow occurs and finally will lead to heap o

Double free issue can happen when sensor power settings is freed by some thread while another thread try to access. in Snapdragon

Vulnerabilities
CISA KEV catalog
CWE weaknesses
CAPEC attack patterns
Package vulnerabilities

Threat intelligence
Threat actors
Tools & malware
ATT&CK techniques
IOCs

Detection & defense
Sigma rules
YARA rules
Atomic Red Team tests
D3FEND countermeasures

Compliance
NIST 800-53
ISO 27001:2022
SOC 2 TSC
PCI-DSS v4.0
CIS Controls v8.1

About
All capabilities
Live statistics
Data sources
Privacy policy
Terms of service

threatengine.sh · Open-source threat intelligence platform · 100+ authoritative sources · Every fact traces to its origin