by Kastro
Paper/Archive/CVE-2023-43551

CVE-2023-43551

Qualcomm, Inc. Snapdragon — Improper Authentication in Multi-Mode Call Processor

EPSS 0.3%CVSS 9.1
critical.is priorityof 100
31
CVSS 9.1 (CNA)9.1 / 10 × 3027.3Not in CISA KEV+300.0EPSS percentile 17.3.173 × 203.5No public exploit+100.0SSVC exploitation: none+100.0
Description · from the CVE record

Cryptographic issue while performing attach with a LTE network, a rogue base station can skip the authentication phase and immediately send the Security Mode Command.

Affected

ProductAffectedFixed inSource
Snapdragon315 5G IoT Modem–CNA
Snapdragon9205 LTE Modem–CNA
Snapdragon9206 LTE Modem–CNA
Snapdragon9207 LTE Modem–CNA
SnapdragonAPQ8017–CNA
SnapdragonAPQ8037–CNA
SnapdragonAQT1000–CNA
SnapdragonAR6003–CNA
SnapdragonAR8035–CNA
SnapdragonC-V2X 9150–CNA
SnapdragonCSRA6620–CNA
SnapdragonCSRA6640–CNA

Scores by source

qualcomm (CNA)9.1CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N
CISA ADPSSVCExploitation: none · Automatable: yes · Technical impact: total

References

refdocs.qualcomm.com/product/publicresources/securitybulletin/june-2024-bulletin.html