CVE-2021-35081
Possible buffer overflow due to improper validation of SSID length received from beacon or probe response during an IBSS session in Snapdragon Auto, Snapdragon Compute, Snapdragon Connectivity, Snapdragon Consumer Electronics Connectivity, Snapdragon…
Does this matter?
High impact if exploited, but EPSS currently rates exploitation as unlikely (0.81%). Schedule it in the normal patch cycle and watch for a rise in EPSS or a public exploit.
Description
Possible buffer overflow due to improper validation of SSID length received from beacon or probe response during an IBSS session in Snapdragon Auto, Snapdragon Compute, Snapdragon Connectivity, Snapdragon Consumer Electronics Connectivity, Snapdragon Industrial IOT, Snapdragon Mobile, Snapdragon Voice & Music
- CVSS 3.1
- 9.8 CRITICALCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
- EPSS
- 0.81% probability · 55th percentile
- CISA KEV
- Not listed
- Weakness
- CWE-120
- Affected
- qualcomm/aqt1000 firmware · qualcomm/ar8035 firmware · qualcomm/qca6390 firmware · qualcomm/qca6391 firmware · qualcomm/qca6564 firmware · qualcomm/qca6564au firmware · qualcomm/qca6574a firmware · qualcomm/qca8081 firmware · qualcomm/qca8337 firmware · qualcomm/qcm2290 firmware · qualcomm/qcm4290 firmware · qualcomm/qcm6125 firmware · qualcomm/qcm6490 firmware · qualcomm/qcn7605 firmware · qualcomm/qcn7606 firmware · qualcomm/qcs2290 firmware · qualcomm/qcs4290 firmware · qualcomm/qcs610 firmware · qualcomm/qcs6125 firmware · qualcomm/qcs6490 firmware · +40 more
- Source
- product-security@qualcomm.com
References
- https://www.qualcomm.com/company/product-security/bulletins/april-2022-bulletinPatch, Vendor Advisory
- https://www.qualcomm.com/company/product-security/bulletins/april-2022-bulletinPatch, Vendor Advisory
Source: NVD record, EPSS from FIRST.org, KEV from CISA. Refreshed daily.