Vulnerability Name: CVE-2019-10601 (CCN-173458) Assigned: 2019-12-02 Published: 2019-12-02 Updated: 2019-12-22 Summary: Out of bound access can occur while processing firmware event due to lack of validation of WMI message received from firmware in Snapdragon Auto, Snapdragon Consumer Electronics Connectivity, Snapdragon Industrial IOT, Snapdragon Mobile, Snapdragon Voice & Music, Snapdragon Wired Infrastructure and Networking in APQ8096AU, IPQ4019, IPQ8064, IPQ8074, MSM8996AU, Nicobar, QCA6574AU, QCN7605, QCS405, SDM630, SDM636, SDM660, SDM845, SM6150, SM7150, SM8150 CVSS v3 Severity: 7.8 High (CVSS v3.1 Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H )6.8 Medium (Temporal CVSS v3.1 Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C )Exploitability Metrics: Attack Vector (AV): LocalAttack Complexity (AC): LowPrivileges Required (PR): LowUser Interaction (UI): NoneScope: Scope (S): UnchangedImpact Metrics: Confidentiality (C): HighIntegrity (I): HighAvailibility (A): High
8.4 High (CCN CVSS v3.1 Vector: CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H )7.3 High (CCN Temporal CVSS v3.1 Vector: CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C )Exploitability Metrics: Attack Vector (AV): LocalAttack Complexity (AC): LowPrivileges Required (PR): NoneUser Interaction (UI): NoneScope: Scope (S): UnchangedImpact Metrics: Confidentiality (C): HighIntegrity (I): HighAvailibility (A): High
CVSS v2 Severity: 7.2 High (CVSS v2 Vector: AV:L/AC:L/Au:N/C:C/I:C/A:C )Exploitability Metrics: Access Vector (AV): LocalAccess Complexity (AC): LowAuthentication (Au): NoneImpact Metrics: Confidentiality (C): CompleteIntegrity (I): CompleteAvailibility (A): Complete
7.2 High (CCN CVSS v2 Vector: AV:L/AC:L/Au:N/C:C/I:C/A:C )Exploitability Metrics: Access Vector (AV): LocalAccess Complexity (AC): LowAthentication (Au): NoneImpact Metrics: Confidentiality (C): CompleteIntegrity (I): CompleteAvailibility (A): Complete
Vulnerability Type: CWE-129 Vulnerability Consequences: Gain Access References: Source: MITRE Type: CNACVE-2019-10601 Source: XF Type: UNKNOWNqualcomm-cve201910601-code-exec(173458) Source: CCN Type: Qualcomm Web siteDecember 2019 Security Bulletin Source: CONFIRM Type: Patch, Vendor Advisoryhttps://www.qualcomm.com/company/product-security/bulletins/december-2019-bulletin Vulnerable Configuration: Configuration 1 :cpe:/o:qualcomm:apq8096au_firmware:-:*:*:*:*:*:*:* AND cpe:/h:qualcomm:apq8096au:-:*:*:*:*:*:*:* Configuration 2 :cpe:/o:qualcomm:ipq4019_firmware:-:*:*:*:*:*:*:* AND cpe:/h:qualcomm:ipq4019:-:*:*:*:*:*:*:* Configuration 3 :cpe:/o:qualcomm:ipq8064_firmware:-:*:*:*:*:*:*:* AND cpe:/h:qualcomm:ipq8064:-:*:*:*:*:*:*:* Configuration 4 :cpe:/o:qualcomm:ipq8074_firmware:-:*:*:*:*:*:*:* AND cpe:/h:qualcomm:ipq8074:-:*:*:*:*:*:*:* Configuration 5 :cpe:/o:qualcomm:msm8996au_firmware:-:*:*:*:*:*:*:* AND cpe:/h:qualcomm:msm8996au:-:*:*:*:*:*:*:* Configuration 6 :cpe:/o:qualcomm:nicobar_firmware:-:*:*:*:*:*:*:* AND cpe:/h:qualcomm:nicobar:-:*:*:*:*:*:*:* Configuration 7 :cpe:/o:qualcomm:qca6574au_firmware:-:*:*:*:*:*:*:* AND cpe:/h:qualcomm:qca6574au:-:*:*:*:*:*:*:* Configuration 8 :cpe:/o:qualcomm:qcn7605_firmware:-:*:*:*:*:*:*:* AND cpe:/h:qualcomm:qcn7605:-:*:*:*:*:*:*:* Configuration 9 :cpe:/o:qualcomm:qcs405_firmware:-:*:*:*:*:*:*:* AND cpe:/h:qualcomm:qcs405:-:*:*:*:*:*:*:* Configuration 10 :cpe:/o:qualcomm:sdm630_firmware:-:*:*:*:*:*:*:* AND cpe:/h:qualcomm:sdm630:-:*:*:*:*:*:*:* Configuration 11 :cpe:/o:qualcomm:sdm636_firmware:-:*:*:*:*:*:*:* AND cpe:/h:qualcomm:sdm636:-:*:*:*:*:*:*:* Configuration 12 :cpe:/o:qualcomm:sdm660_firmware:-:*:*:*:*:*:*:* AND cpe:/h:qualcomm:sdm660:-:*:*:*:*:*:*:* Configuration 13 :cpe:/o:qualcomm:sdm845_firmware:-:*:*:*:*:*:*:* AND cpe:/h:qualcomm:sdm845:-:*:*:*:*:*:*:* Configuration 14 :cpe:/o:qualcomm:sm6150_firmware:-:*:*:*:*:*:*:* AND cpe:/h:qualcomm:sm6150:-:*:*:*:*:*:*:* Configuration 15 :cpe:/o:qualcomm:sm7150_firmware:-:*:*:*:*:*:*:* AND cpe:/h:qualcomm:sm7150:-:*:*:*:*:*:*:* Configuration 16 :cpe:/o:qualcomm:sm8150_firmware:-:*:*:*:*:*:*:* AND cpe:/h:qualcomm:sm8150:-:*:*:*:*:*:*:* Configuration CCN 1 :cpe:/h:qualcomm:snapdragon_mobile:-:*:*:*:*:*:*:* OR cpe:/h:qualcomm:snapdragon_auto:-:*:*:*:*:*:*:* OR cpe:/h:qualcomm:snapdragon_consumer_electronics_connectivity:-:*:*:*:*:*:*:* OR cpe:/h:qualcomm:snapdragon_industrial_internet_of_things:-:*:*:*:*:*:*:* OR cpe:/h:qualcomm:snapdragon_voice_&_music:-:*:*:*:*:*:*:* OR cpe:/o:qualcomm:snapdragon_wired_infrastructure_&_networking:-:*:*:*:*:*:*:* Denotes that component is vulnerable BACK
qualcomm apq8096au firmware -
qualcomm apq8096au -
qualcomm ipq4019 firmware -
qualcomm ipq4019 -
qualcomm ipq8064 firmware -
qualcomm ipq8064 -
qualcomm ipq8074 firmware -
qualcomm ipq8074 -
qualcomm msm8996au firmware -
qualcomm msm8996au -
qualcomm nicobar firmware -
qualcomm nicobar -
qualcomm qca6574au firmware -
qualcomm qca6574au -
qualcomm qcn7605 firmware -
qualcomm qcn7605 -
qualcomm qcs405 firmware -
qualcomm qcs405 -
qualcomm sdm630 firmware -
qualcomm sdm630 -
qualcomm sdm636 firmware -
qualcomm sdm636 -
qualcomm sdm660 firmware -
qualcomm sdm660 -
qualcomm sdm845 firmware -
qualcomm sdm845 -
qualcomm sm6150 firmware -
qualcomm sm6150 -
qualcomm sm7150 firmware -
qualcomm sm7150 -
qualcomm sm8150 firmware -
qualcomm sm8150 -
qualcomm snapdragon mobile -
qualcomm snapdragon auto -
qualcomm snapdragon consumer electronics connectivity -
qualcomm snapdragon industrial internet of things -
qualcomm snapdragon voice & music -
qualcomm snapdragon wired infrastructure & networking -