by Kastro
Paper/Archive/CVE-2023-33054

CVE-2023-33054

Qualcomm, Inc. Snapdragon — Improper Authentication in GPS HLOS Driver

EPSS 0.4%CVSS 9.1
critical.is priorityof 100
33
CVSS 9.1 (CNA, NVD agree)9.1 / 10 × 3027.3Not in CISA KEV+300.0EPSS percentile 29.9.299 × 206.0No public exploit+100.0SSVC exploitation: unknown+100.0
Description · from the CVE record

Cryptographic issue in GPS HLOS Driver while downloading Qualcomm GNSS assistance data.

Affected

ProductAffectedFixed inSource
Snapdragon315 5G IoT Modem–CNA
SnapdragonAQT1000–CNA
SnapdragonAR8035–CNA
SnapdragonCSRA6620–CNA
SnapdragonCSRA6640–CNA
SnapdragonFastConnect 6200–CNA
SnapdragonFastConnect 6700–CNA
SnapdragonFastConnect 6800–CNA
SnapdragonFastConnect 6900–CNA
SnapdragonFastConnect 7800–CNA
SnapdragonQAM8295P–CNA
SnapdragonQCA6174A–CNA

Scores by source

NVD9.1CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N
qualcomm (CNA)9.1CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N

References

refqualcomm.com/company/product-security/bulletins/december-2023-bulletin