CVE-2020-3675
u'Potential integer underflow while parsing Service Info and IPv6 link-local TLVs that comes as part of NDPE attribute' in Snapdragon Auto, Snapdragon Compute, Snapdragon Connectivity, Snapdragon Consumer Electronics Connectivity, Snapdragon Industrial…
Does this matter?
High impact if exploited, but EPSS currently rates exploitation as unlikely (1.06%). Schedule it in the normal patch cycle and watch for a rise in EPSS or a public exploit.
Description
u'Potential integer underflow while parsing Service Info and IPv6 link-local TLVs that comes as part of NDPE attribute' in Snapdragon Auto, Snapdragon Compute, Snapdragon Connectivity, Snapdragon Consumer Electronics Connectivity, Snapdragon Industrial IOT, Snapdragon Mobile, Snapdragon Voice & Music, Snapdragon Wired Infrastructure and Networking in IPQ5018, IPQ6018, IPQ8074, Kamorta, Nicobar, QCA6390, QCN7605, QCS404, QCS405, Rennell, SA415M, Saipan, SC7180, SC8180X, SDX55, SM6150, SM7150, SM8150, SM8250
- CVSS 3.1
- 9.8 CRITICALCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
- EPSS
- 1.06% probability · 63th percentile
- CISA KEV
- Not listed
- Weakness
- CWE-191
- Affected
- qualcomm/ipq5018 firmware · qualcomm/ipq6018 firmware · qualcomm/ipq8074 firmware · qualcomm/kamorta firmware · qualcomm/nicobar firmware · qualcomm/qca6390 firmware · qualcomm/qcn7605 firmware · qualcomm/qcs404 firmware · qualcomm/qcs405 firmware · qualcomm/rennell firmware · qualcomm/sa415m firmware · qualcomm/saipan firmware · qualcomm/sc7180 firmware · qualcomm/sc8180x firmware · qualcomm/sdx55 firmware · qualcomm/sm6150 firmware · qualcomm/sm7150 firmware · qualcomm/sm8150 firmware · qualcomm/sm8250 firmware
- Source
- product-security@qualcomm.com
References
- https://www.qualcomm.com/company/product-security/bulletins/august-2020-bulletinBroken Link, Vendor Advisory
- https://www.qualcomm.com/company/product-security/bulletins/august-2020-bulletinBroken Link, Vendor Advisory
Source: NVD record, EPSS from FIRST.org, KEV from CISA. Refreshed daily.