by Kastro
Paper/Archive/CVE-2023-21631

CVE-2023-21631

Qualcomm, Inc. Snapdragon — Improper Input Validation in Modem

EPSS 0.4%CVSS 9.8
critical.is priorityof 100
35
CVSS 9.8 (NVD)9.8 / 10 × 3029.4Not in CISA KEV+300.0EPSS percentile 30.0.300 × 206.0No public exploit+100.0SSVC exploitation: none+100.0
Description · from the CVE record

Weak Configuration due to improper input validation in Modem while processing LTE security mode command message received from network.

Affected

ProductAffectedFixed inSource
Snapdragon315 5G IoT Modem–CNA
Snapdragon9205 LTE Modem–CNA
SnapdragonAPQ8017–CNA
SnapdragonAPQ8037–CNA
SnapdragonAQT1000–CNA
SnapdragonAR8035–CNA
SnapdragonC-V2X 9150–CNA
SnapdragonCSRA6620–CNA
SnapdragonCSRA6640–CNA
SnapdragonCSRB31024–CNA
SnapdragonFastConnect 6200–CNA
SnapdragonFastConnect 6700–CNA

Scores by source

NVD9.8CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
qualcomm (CNA)7.5CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N
CISA ADPSSVCExploitation: none · Automatable: yes · Technical impact: partial

References

refqualcomm.com/company/product-security/bulletins/july-2023-bulletin