CVE-2021-35129
Memory corruption in BT controller due to improper length check while processing vendor specific commands in Snapdragon Compute, Snapdragon Connectivity, Snapdragon Consumer Electronics Connectivity, Snapdragon Industrial IOT, Snapdragon Mobile,…
Does this matter?
High impact if exploited, but EPSS currently rates exploitation as unlikely (0.16%). Schedule it in the normal patch cycle and watch for a rise in EPSS or a public exploit.
Description
Memory corruption in BT controller due to improper length check while processing vendor specific commands in Snapdragon Compute, Snapdragon Connectivity, Snapdragon Consumer Electronics Connectivity, Snapdragon Industrial IOT, Snapdragon Mobile, Snapdragon Wired Infrastructure and Networking
- CVSS 3.1
- 7.8 HIGHCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
- EPSS
- 0.16% probability · 5th percentile
- CISA KEV
- Not listed
- Weakness
- CWE-120
- Affected
- qualcomm/ar8035 firmware · qualcomm/ipq5010 firmware · qualcomm/ipq5018 firmware · qualcomm/ipq5028 firmware · qualcomm/qca2062 firmware · qualcomm/qca2064 firmware · qualcomm/qca2065 firmware · qualcomm/qca2066 firmware · qualcomm/qca6391 firmware · qualcomm/qca8081 firmware · qualcomm/qca8337 firmware · qualcomm/qcc710 firmware · qualcomm/qcm6490 firmware · qualcomm/qcn6023 firmware · qualcomm/qcn6024 firmware · qualcomm/qcn6100 firmware · qualcomm/qcn6102 firmware · qualcomm/qcn6112 firmware · qualcomm/qcn6122 firmware · qualcomm/qcn6132 firmware · +25 more
- Source
- product-security@qualcomm.com
References
Source: NVD record, EPSS from FIRST.org, KEV from CISA. Refreshed daily.