by Kastro
Paper/Archive/CVE-2022-25745

CVE-2022-25745

Qualcomm, Inc. Snapdragon — Always Incorrect Control Flow Implementation in MODEM

EPSS 0.4%CVSS 9.8
critical.is priorityof 100
37
CVSS 9.8 (NVD, CNA agree)9.8 / 10 × 3029.4Not in CISA KEV+300.0EPSS percentile 36.0.360 × 207.2No public exploit+100.0SSVC exploitation: none+100.0
Description · from the CVE record

Memory corruption in modem due to improper input validation while handling the incoming CoAP message

Affected

ProductAffectedFixed inSource
Snapdragon9205 LTE Modem–CNA
SnapdragonQCA4004–CNA
SnapdragonQTS110–CNA
SnapdragonSnapdragon Wear 1300 Platform–CNA
SnapdragonWCD9306–CNA
9205_lte_modem_firmwareall versions–CISA-ADP
qca4004_firmwareall versions–CISA-ADP
qts110_firmwareall versions–CISA-ADP
snapdragon_wear_1300_platform_firmwareall versions–CISA-ADP
wcd9306_firmwareall versions–CISA-ADP

Scores by source

NVD9.8CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
qualcomm (CNA)9.8CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
CISA ADPSSVCExploitation: none · Automatable: yes · Technical impact: total

References

refqualcomm.com/company/product-security/bulletins/april-2023-bulletin