by Kastro
Paper/Archive/CVE-2022-25678

CVE-2022-25678

Qualcomm, Inc. Snapdragon — Buffer Copy Without Checking Size of Input in MODEM

EPSS 0.4%CVSS 9.8
critical.is priorityof 100
37
CVSS 9.8 (NVD, CNA agree)9.8 / 10 × 3029.4Not in CISA KEV+300.0EPSS percentile 36.0.360 × 207.2No public exploit+100.0SSVC exploitation: none+100.0
Description · from the CVE record

Memory correction in modem due to buffer overwrite during coap connection

Affected

ProductAffectedFixed inSource
Snapdragon9205 LTE Modem–CNA
Snapdragon9206 LTE Modem–CNA
Snapdragon9207 LTE Modem–CNA
SnapdragonMDM8207–CNA
SnapdragonQCA4004–CNA
SnapdragonQTS110–CNA
SnapdragonSnapdragon 1100 Wearable Platform–CNA
SnapdragonSnapdragon 1200 Wearable Platform–CNA
SnapdragonSnapdragon Wear 1300 Platform–CNA
SnapdragonSnapdragon X5 LTE Modem–CNA
SnapdragonWCD9306–CNA
SnapdragonWCD9330–CNA

Scores by source

NVD9.8CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
qualcomm (CNA)9.8CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
CISA ADPSSVCExploitation: none · Automatable: no · Technical impact: partial

References

refqualcomm.com/company/product-security/bulletins/april-2023-bulletin