SOC status:Duty analyst on shift

UK Cyber Defence
VulnerabilityModified

CVE-2019-10507

Lack of check of extscan change results received from firmware can lead to an out of buffer read in Snapdragon Auto, Snapdragon Consumer Electronics Connectivity, Snapdragon Consumer IOT, Snapdragon Industrial IOT, Snapdragon Mobile, Snapdragon Voice &…

HIGH 7.8EPSS 0.19%

Does this matter?

High impact if exploited, but EPSS currently rates exploitation as unlikely (0.19%). Schedule it in the normal patch cycle and watch for a rise in EPSS or a public exploit.

Description

Lack of check of extscan change results received from firmware can lead to an out of buffer read in Snapdragon Auto, Snapdragon Consumer Electronics Connectivity, Snapdragon Consumer IOT, Snapdragon Industrial IOT, Snapdragon Mobile, Snapdragon Voice & Music in MDM9150, MDM9206, MDM9607, MDM9640, MDM9650, MSM8996AU, QCA6174A, QCA6574AU, QCA9377, QCA9379, QCS605, SD 210/SD 212/SD 205, SD 425, SD 430, SD 600, SD 625, SD 636, SD 665, SD 675, SD 712 / SD 710 / SD 670, SD 730, SD 820A, SD 835, SD 845 / SD 850, SD 855, SDA660, SDM630, SDM660, SDX20, SDX24

CVSS 3.1
7.8 HIGHCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
EPSS
0.19% probability · 9th percentile
CISA KEV
Not listed
Weakness
CWE-125
Affected
qualcomm/mdm9150 firmware · qualcomm/mdm9206 firmware · qualcomm/mdm9607 firmware · qualcomm/mdm9640 firmware · qualcomm/mdm9650 firmware · qualcomm/msm8996au firmware · qualcomm/qca6174a firmware · qualcomm/qca6574au firmware · qualcomm/qca9377 firmware · qualcomm/qca9379 firmware · qualcomm/qcs605 firmware · qualcomm/sd 210 firmware · qualcomm/sd 212 firmware · qualcomm/sd 205 firmware · qualcomm/sd 425 firmware · qualcomm/sd 430 firmware · qualcomm/sd 600 firmware · qualcomm/sd 625 firmware · qualcomm/sd 636 firmware · qualcomm/sd 665 firmware · +15 more
Source
product-security@qualcomm.com

References

Source: NVD record, EPSS from FIRST.org, KEV from CISA. Refreshed daily.