SOC status:Duty analyst on shift

UK Cyber Defence
VulnerabilityModified

CVE-2018-13898

Out-of-Bounds write due to incorrect array index check in PMIC in Snapdragon Auto, Snapdragon Compute, Snapdragon Consumer Electronics Connectivity, Snapdragon Consumer IOT, Snapdragon Industrial IOT, Snapdragon Mobile, Snapdragon Voice & Music in…

CRITICAL 9.8EPSS 0.73%

Does this matter?

High impact if exploited, but EPSS currently rates exploitation as unlikely (0.73%). Schedule it in the normal patch cycle and watch for a rise in EPSS or a public exploit.

Description

Out-of-Bounds write due to incorrect array index check in PMIC in Snapdragon Auto, Snapdragon Compute, Snapdragon Consumer Electronics Connectivity, Snapdragon Consumer IOT, Snapdragon Industrial IOT, Snapdragon Mobile, Snapdragon Voice & Music in MDM9150, MDM9206, MDM9607, MDM9650, MDM9655, QCS405, QCS605, Qualcomm 215, SD 210/SD 212/SD 205, SD 410/12, SD 425, SD 427, SD 430, SD 435, SD 439 / SD 429, SD 450, SD 625, SD 632, SD 636, SD 675, SD 712 / SD 710 / SD 670, SD 730, SD 835, SD 845 / SD 850, SD 855, SD 8CX, SDA660, SDM439, SDM630, SDM660, SDX24, Snapdragon_High_Med_2016, SXR1130

CVSS 3.0
9.8 CRITICALCVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
EPSS
0.73% probability · 52th percentile
CISA KEV
Not listed
Weakness
CWE-787
Affected
qualcomm/mdm9150 firmware · qualcomm/mdm9206 firmware · qualcomm/mdm9607 firmware · qualcomm/mdm9650 firmware · qualcomm/mdm9655 firmware · qualcomm/qcs405 firmware · qualcomm/qcs605 firmware · qualcomm/qualcomm 215 firmware · qualcomm/sd 210 firmware · qualcomm/sd 212 firmware · qualcomm/sd 205 firmware · qualcomm/sd 410 firmware · qualcomm/sd 412 firmware · qualcomm/sd 425 firmware · qualcomm/sd 427 firmware · qualcomm/sd 430 firmware · qualcomm/sd 435 firmware · qualcomm/sd 439 firmware · qualcomm/sd 429 firmware · qualcomm/sd 450 firmware · +20 more
Source
product-security@qualcomm.com

References

Source: NVD record, EPSS from FIRST.org, KEV from CISA. Refreshed daily.