by Kastro
Paper/Archive/CVE-2023-28540

CVE-2023-28540

Qualcomm, Inc. Snapdragon — Improper Authentication in Data Modem

EPSS 0.4%CVSS 9.1
critical.is priorityof 100
35
CVSS 9.1 (CNA)9.1 / 10 × 3027.3Not in CISA KEV+300.0EPSS percentile 37.4.374 × 207.5No public exploit+100.0SSVC exploitation: none+100.0
Description · from the CVE record

Cryptographic issue in Data Modem due to improper authentication during TLS handshake.

Affected

ProductAffectedFixed inSource
Snapdragon315 5G IoT Modem–CNA
SnapdragonAQT1000–CNA
SnapdragonAR8035–CNA
SnapdragonCSRA6620–CNA
SnapdragonCSRA6640–CNA
SnapdragonFastConnect 6200–CNA
SnapdragonFastConnect 6700–CNA
SnapdragonFastConnect 6800–CNA
SnapdragonFastConnect 6900–CNA
SnapdragonFastConnect 7800–CNA
SnapdragonQCA6391–CNA
SnapdragonQCA6420–CNA

Scores by source

qualcomm (CNA)9.1CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N
CISA ADPSSVCExploitation: none · Automatable: yes · Technical impact: total

References

refqualcomm.com/company/product-security/bulletins/october-2023-bulletin