How severe is CVE-2021-30304?

CVE-2021-30304 has a CVSS 3.x base score of 7.5, rated high severity. It is exploitable over network with low attack complexity, requires no privileges and no user interaction. Impact on confidentiality is none, integrity none, and availability high.

Is CVE-2021-30304 being actively exploited?

It is not currently listed in CISA's KEV catalog. Its EPSS exploit-prediction score is 1% (44th percentile), an estimate of the probability of exploitation in the next 30 days.

What products are affected by CVE-2021-30304?

CVE-2021-30304 primarily affects Qualcomm Qca2062 Firmware. In total, 13 product configurations (CPEs) are listed as vulnerable; see the affected-products list for the exact versions.

How do I fix CVE-2021-30304?

Review the linked vendor and NVD advisories for patched versions and mitigations, then upgrade or apply the recommended workaround. Given its high severity, prioritise patching exposed systems.

When was CVE-2021-30304 published?

CVE-2021-30304 was published on 2021-10-20 and last updated on 2026-06-17.

CVE-2021-30304

CVE-2021-30304 is a high-severity vulnerability in Qualcomm Qca2062 Firmware with a CVSS 3.x base score of 7.5. It is not currently listed as actively exploited by CISA, and its EPSS exploit-prediction score is low. The underlying weakness is classified as CWE-125.

Key facts

Severity: High (CVSS 3.x base score 7.5)
CVSS v2: 6.4
EPSS exploit prediction: 1% (44th percentile)
Actively exploited: Not listed in CISA KEV
Weakness: CWE-125
Affected product: Qualcomm Qca2062 Firmware
Published: 2021-10-20
Last modified: 2026-06-17

Description

Possible buffer out of bound read can occur due to improper validation of TBTT count and length while parsing the beacon response in Snapdragon Compute, Snapdragon Connectivity, Snapdragon Consumer Electronics Connectivity

Frequently asked questions

What is CVE-2021-30304?: Possible buffer out of bound read can occur due to improper validation of TBTT count and length while parsing the beacon response in Snapdragon Compute, Snapdragon Connectivity, Snapdragon Consumer Electronics Connectivity
How severe is CVE-2021-30304?: CVE-2021-30304 has a CVSS 3.x base score of 7.5, rated high severity. It is exploitable over network with low attack complexity, requires no privileges and no user interaction. Impact on confidentiality is none, integrity none, and availability high.
Is CVE-2021-30304 being actively exploited?: It is not currently listed in CISA's KEV catalog. Its EPSS exploit-prediction score is 1% (44th percentile), an estimate of the probability of exploitation in the next 30 days.
What products are affected by CVE-2021-30304?: CVE-2021-30304 primarily affects Qualcomm Qca2062 Firmware. In total, 13 product configurations (CPEs) are listed as vulnerable; see the affected-products list for the exact versions.
How do I fix CVE-2021-30304?: Review the linked vendor and NVD advisories for patched versions and mitigations, then upgrade or apply the recommended workaround. Given its high severity, prioritise patching exposed systems.
When was CVE-2021-30304 published?: CVE-2021-30304 was published on 2021-10-20 and last updated on 2026-06-17.

References

https://www.qualcomm.com/company/product-security/bulletins/october-2021-bulletin

Affected products (13)

cpe:2.3:o:qualcomm:qca2062_firmware:-:*:*:*:*:*:*:*
cpe:2.3:o:qualcomm:qca2064_firmware:-:*:*:*:*:*:*:*
cpe:2.3:o:qualcomm:qca2065_firmware:-:*:*:*:*:*:*:*
cpe:2.3:o:qualcomm:qca2066_firmware:-:*:*:*:*:*:*:*
cpe:2.3:o:qualcomm:sc8280xp_firmware:-:*:*:*:*:*:*:*
cpe:2.3:o:qualcomm:wcd9380_firmware:-:*:*:*:*:*:*:*
cpe:2.3:o:qualcomm:wcd9385_firmware:-:*:*:*:*:*:*:*
cpe:2.3:o:qualcomm:wcn6850_firmware:-:*:*:*:*:*:*:*
cpe:2.3:o:qualcomm:wcn6851_firmware:-:*:*:*:*:*:*:*
cpe:2.3:o:qualcomm:wcn6855_firmware:-:*:*:*:*:*:*:*
cpe:2.3:o:qualcomm:wcn6856_firmware:-:*:*:*:*:*:*:*
cpe:2.3:o:qualcomm:wsa8830_firmware:-:*:*:*:*:*:*:*
cpe:2.3:o:qualcomm:wsa8835_firmware:-:*:*:*:*:*:*:*

More vulnerabilities in Qualcomm Qca2062 Firmware

CVE-2023-33028 — Critical (CVSS 9.8): Memory corruption in WLAN Firmware while doing a memory copy of pmk cache.
CVE-2022-40514 — Critical (CVSS 9.8): Memory corruption due to buffer copy without checking the size of input in WLAN Firmware while processing CCKM IE in…
CVE-2022-25748 — Critical (CVSS 9.8): Memory corruption in WLAN due to integer overflow to buffer overflow while parsing GTK frames. in Snapdragon Auto,…
CVE-2020-11264 — Critical (CVSS 9.1): Improper authentication of Non-EAPOL/WAPI plaintext frames during four-way handshake can lead to arbitrary network…
CVE-2023-33088 — High (CVSS 8.4): Memory corruption when processing cmd parameters while parsing vdev.
CVE-2022-33275 — High (CVSS 8.4): Memory corruption due to improper validation of array index in WLAN HAL when received lm_itemNum is out of range.

All CVEs affecting Qualcomm Qca2062 Firmware →

Other CWE-125 (Out-of-bounds Read) vulnerabilities

CVE-2026-24826 — Critical (CVSS 10.0): Out-of-bounds Write, Divide By Zero, NULL Pointer Dereference, Use of Uninitialized Resource, Out-of-bounds Read,…
CVE-2024-22004 — Critical (CVSS 10.0): Due to length check, an attacker with privilege access on a Linux Nonsecure operating system can trigger a…
CVE-2021-41556 — Critical (CVSS 10.0): sqclass.cpp in Squirrel through 2.2.5 and 3.x through 3.1 allows an out-of-bounds read (in the core interpreter) that…
CVE-2021-21777 — Critical (CVSS 10.0): An information disclosure vulnerability exists in the Ethernet/IP UDP handler functionality of EIP Stack Group OpENer…
CVE-2017-14451 — Critical (CVSS 10.0): An exploitable out-of-bounds read vulnerability exists in libevm (Ethereum Virtual Machine) of CPP-Ethereum. A…
CVE-2013-0767 — Critical (CVSS 10.0): The nsSVGPathElement::GetPathLengthScale function in Mozilla Firefox before 18.0, Firefox ESR 10.x before 10.0.12 and…

Browse all CWE-125 (Out-of-bounds Read) vulnerabilities →