CVE-2019-2267
CVE-2019-2267 is a high-severity vulnerability in Qualcomm Mdm9205 Firmware with a CVSS 3.x base score of 7.8. It is not currently listed as actively exploited by CISA, and its EPSS exploit-prediction score is low.
Key facts
- Severity: High (CVSS 3.x base score 7.8)
- CVSS v2: 7.2
- EPSS exploit prediction: 0% (13th percentile)
- Actively exploited: Not listed in CISA KEV
- Affected product: Qualcomm Mdm9205 Firmware
- Published:
- Last modified:
Description
Locked regions may be modified through other interfaces in secure boot loader image due to improper access control. in Snapdragon Auto, Snapdragon Compute, Snapdragon Connectivity, Snapdragon Consumer IOT, Snapdragon Industrial IOT, Snapdragon Mobile, Snapdragon Wired Infrastructure and Networking in MDM9205, QCS404, QCS605, SDA845, SDM670, SDM710, SDM845, SDM850, SM8150, SXR1130, SXR2130
Frequently asked questions
- What is CVE-2019-2267?
- Locked regions may be modified through other interfaces in secure boot loader image due to improper access control. in Snapdragon Auto, Snapdragon Compute, Snapdragon Connectivity, Snapdragon Consumer IOT, Snapdragon Industrial IOT, Snapdragon Mobile, Snapdragon Wired Infrastructure and Networking in MDM9205, QCS404, QCS605, SDA845, SDM670, SDM710, SDM845, SDM850, SM8150, SXR1130, SXR2130
- How severe is CVE-2019-2267?
- CVE-2019-2267 has a CVSS 3.x base score of 7.8, rated high severity. It is exploitable over local access with low attack complexity, requires low privileges and no user interaction. Impact on confidentiality is high, integrity high, and availability high.
- Is CVE-2019-2267 being actively exploited?
- It is not currently listed in CISA's KEV catalog. Its EPSS exploit-prediction score is 0% (13th percentile), an estimate of the probability of exploitation in the next 30 days.
- What products are affected by CVE-2019-2267?
- CVE-2019-2267 primarily affects Qualcomm Mdm9205 Firmware. In total, 11 product configurations (CPEs) are listed as vulnerable; see the affected-products list for the exact versions.
- How do I fix CVE-2019-2267?
- Review the linked vendor and NVD advisories for patched versions and mitigations, then upgrade or apply the recommended workaround. Given its high severity, prioritise patching exposed systems.
- When was CVE-2019-2267 published?
- CVE-2019-2267 was published on 2020-01-21 and last updated on 2026-06-17.
References
Affected products (11)
- cpe:2.3:o:qualcomm:mdm9205_firmware:-:*:*:*:*:*:*:*
- cpe:2.3:o:qualcomm:qcs404_firmware:-:*:*:*:*:*:*:*
- cpe:2.3:o:qualcomm:qcs605_firmware:-:*:*:*:*:*:*:*
- cpe:2.3:o:qualcomm:sda845_firmware:-:*:*:*:*:*:*:*
- cpe:2.3:o:qualcomm:sdm670_firmware:-:*:*:*:*:*:*:*
- cpe:2.3:o:qualcomm:sdm710_firmware:-:*:*:*:*:*:*:*
- cpe:2.3:o:qualcomm:sdm845_firmware:-:*:*:*:*:*:*:*
- cpe:2.3:o:qualcomm:sdm850_firmware:-:*:*:*:*:*:*:*
- cpe:2.3:o:qualcomm:sm8150_firmware:-:*:*:*:*:*:*:*
- cpe:2.3:o:qualcomm:sxr1130_firmware:-:*:*:*:*:*:*:*
- cpe:2.3:o:qualcomm:sxr2130_firmware:-:*:*:*:*:*:*:*
More vulnerabilities in Qualcomm Mdm9205 Firmware
- CVE-2022-33259 — Critical (CVSS 9.8): Memory corruption due to buffer copy without checking the size of input in modem while decoding raw SMS received.
- CVE-2022-33211 — Critical (CVSS 9.8): memory corruption in modem due to improper check while calculating size of serialized CoAP message
- CVE-2022-25745 — Critical (CVSS 9.8): Memory corruption in modem due to improper input validation while handling the incoming CoAP message
- CVE-2022-25740 — Critical (CVSS 9.8): Memory corruption in modem due to buffer overwrite while building an IPv6 multicast address based on the MAC address of…
- CVE-2022-25678 — Critical (CVSS 9.8): Memory correction in modem due to buffer overwrite during coap connection
- CVE-2022-25729 — Critical (CVSS 9.8): Memory corruption in modem due to improper length check while copying into memory