Qualcomm Wcn685x-5 Firmware — known CVE vulnerabilities

Every CVE whose affected-product data names Qualcomm Wcn685x-5 Firmware, ordered by CVSS severity, with EPSS exploit prediction and CISA KEV status.

CVEs (93)

• CVE-2023-33082 — CVSS 9.8 (critical): Memory corruption while sending an Assoc Request having BTM Query or BTM Response containing MBO IE.
• CVE-2023-33083 — CVSS 9.8 (critical): Memory corruption in WLAN Host while processing RRM beacon on the AP.
• CVE-2023-33028 — CVSS 9.8 (critical): Memory corruption in WLAN Firmware while doing a memory copy of pmk cache.
• CVE-2023-33045 — CVSS 9.8 (critical): Memory corruption in WLAN Firmware while parsing a NAN management frame carrying a S3 attribute.
• CVE-2022-33231 — CVSS 9.3 (critical): Memory corruption due to double free in core while initializing the encryption key.
• CVE-2022-33288 — CVSS 9.3 (critical): Memory corruption due to buffer copy without checking the size of input in Core while sending SCM command to get write protection…
• CVE-2022-33269 — CVSS 9.3 (critical): Memory corruption due to integer overflow or wraparound in Core while DDR memory assignment.
• CVE-2023-33054 — CVSS 9.1 (critical): Cryptographic issue in GPS HLOS Driver while downloading Qualcomm GNSS assistance data.
• CVE-2023-28540 — CVSS 9.1 (critical): Cryptographic issue in Data Modem due to improper authentication during TLS handshake.
• CVE-2023-28574 — CVSS 9.0 (critical): Memory corruption in core services when Diag handler receives a command to configure event listeners.
• CVE-2023-21665 — CVSS 8.4 (high): Memory corruption in Graphics while importing a file.
• CVE-2023-21666 — CVSS 8.4 (high): Memory Corruption in Graphics while accessing a buffer allocated through the graphics pool.
• CVE-2023-28537 — CVSS 8.4 (high): Memory corruption while allocating memory in COmxApeDec module in Audio.
• CVE-2023-33022 — CVSS 8.4 (high): Memory corruption in HLOS while invoking IOCTL calls from user-space.
• CVE-2022-33275 — CVSS 8.4 (high): Memory corruption due to improper validation of array index in WLAN HAL when received lm_itemNum is out of range.
• CVE-2023-33053 — CVSS 8.4 (high): Memory corruption in Kernel while parsing metadata.
• CVE-2022-33307 — CVSS 8.4 (high): Memory Corruption due to double free in automotive when a bad HLOS address for one of the lists to be mapped is passed.
• CVE-2022-40507 — CVSS 8.4 (high): Memory corruption due to double free in Core while mapping HLOS address to the list.
• CVE-2023-33029 — CVSS 8.4 (high): Memory corruption in DSP Service during a remote call from HLOS to DSP.
• CVE-2022-40532 — CVSS 8.4 (high): Memory corruption due to integer overflow or wraparound in WLAN while sending WMI cmd from host to target.
• CVE-2022-40534 — CVSS 8.4 (high): Memory corruption due to improper validation of array index in Audio.
• CVE-2023-33074 — CVSS 8.4 (high): Memory corruption in Audio when SSR event is triggered after music playback is stopped.
• CVE-2023-21628 — CVSS 8.4 (high): Memory corruption in WLAN HAL while processing WMI-UTF command or FTM TLV1 command.
• CVE-2023-21630 — CVSS 8.4 (high): Memory Corruption in Multimedia Framework due to integer overflow when synx bind is called along with synx signal.
• CVE-2023-21669 — CVSS 8.2 (high): Information Disclosure in WLAN HOST while sending DPP action frame to peer with an invalid source address.
• CVE-2022-25726 — CVSS 8.2 (high): Information disclosure in modem data due to array out of bound access while handling the incoming DNS response packet
• CVE-2022-33287 — CVSS 8.2 (high): Information disclosure in Modem due to buffer over-read while getting length of Unfragmented headers in an IPv6 packet.
• CVE-2022-40503 — CVSS 8.2 (high): Information disclosure due to buffer over-read in Bluetooth Host while A2DP streaming.
• CVE-2022-25730 — CVSS 8.2 (high): Information disclosure in modem due to improper check of IP type while processing DNS server query
• CVE-2022-33291 — CVSS 8.2 (high): Information disclosure in Modem due to buffer over-read while receiving a IP header with malformed length.
• CVE-2022-33264 — CVSS 7.9 (high): Memory corruption in modem due to stack based buffer overflow while parsing OTASP Key Generation Request Message.
• CVE-2023-33063 — CVSS 7.8 (high) — actively exploited: Memory corruption in DSP Services during a remote call from HLOS to DSP.
• CVE-2023-28560 — CVSS 7.8 (high): Memory corruption in WLAN HAL while processing devIndex from untrusted WMI payload.
• CVE-2023-33017 — CVSS 7.8 (high): Memory corruption in Boot while running a ListVars test in UEFI Menu during boot.
• CVE-2023-33018 — CVSS 7.8 (high): Memory corruption while using the UIM diag command to get the operators name.
• CVE-2023-33031 — CVSS 7.8 (high): Memory corruption in Automotive Audio while copying data from ADSP shared buffer to the VOC packet data buffer.
• CVE-2023-33055 — CVSS 7.8 (high): Memory Corruption in Audio while invoking callback function in driver from ADSP.
• CVE-2023-33059 — CVSS 7.8 (high): Memory corruption in Audio while processing the VOC packet data from ADSP.
• CVE-2023-21670 — CVSS 7.8 (high): Memory Corruption in GPU Subsystem due to arbitrary command execution from GPU in privileged mode.
• CVE-2023-21656 — CVSS 7.8 (high): Memory corruption in WLAN HOST while receiving an WMI event from firmware.
• CVE-2023-33035 — CVSS 7.8 (high): Memory corruption while invoking callback function of AFE from ADSP.
• CVE-2023-33034 — CVSS 7.8 (high): Memory corruption while parsing the ADSP response command.
• CVE-2023-33087 — CVSS 7.8 (high): Memory corruption in Core while processing RX intent request.
• CVE-2022-25713 — CVSS 7.8 (high): Memory corruption in Automotive due to Improper Restriction of Operations within the Bounds of a Memory Buffer while exporting a shared key.
• CVE-2023-21657 — CVSS 7.8 (high): Memoru corruption in Audio when ADSP sends input during record use case.
• CVE-2023-33079 — CVSS 7.8 (high): Memory corruption in Audio while running invalid audio recording from ADSP.
• CVE-2023-28555 — CVSS 7.5 (high): Transient DOS in Audio while remapping channel buffer in media codec decoding.
• CVE-2022-25739 — CVSS 7.5 (high): Denial of service in modem due to missing null check while processing the ipv6 packet received during ECM call
• CVE-2022-33251 — CVSS 7.5 (high): Transient DOS due to reachable assertion in Modem because of invalid network configuration.
• CVE-2022-33270 — CVSS 7.5 (high): Transient DOS due to time-of-check time-of-use race condition in Modem while processing RRC Reconfiguration message.
• CVE-2022-33304 — CVSS 7.5 (high): Transient DOS due to NULL pointer dereference in Modem while performing pullup for received TCP/UDP packet.
• CVE-2022-33305 — CVSS 7.5 (high): Transient DOS due to NULL pointer dereference in Modem while sending invalid messages in DCCH.
• CVE-2022-34144 — CVSS 7.5 (high): Transient DOS due to reachable assertion in Modem during OSI decode scheduling.
• CVE-2022-40504 — CVSS 7.5 (high): Transient DOS due to reachable assertion in Modem when UE received Downlink Data Indication message from the network.
• CVE-2022-40508 — CVSS 7.5 (high): Transient DOS due to reachable assertion in Modem while processing config related to cross carrier scheduling, which is not supported.
• CVE-2022-40521 — CVSS 7.5 (high): Transient DOS due to improper authorization in Modem
• CVE-2022-40536 — CVSS 7.5 (high): Transient DOS due to improper authentication in modem while receiving plain TLB OTA request message from network.
• CVE-2022-40538 — CVSS 7.5 (high): Transient DOS due to reachable assertion in modem while processing sib with incorrect values from network.
• CVE-2023-21658 — CVSS 7.5 (high): Transient DOS in WLAN Firmware while processing the received beacon or probe response frame.
• CVE-2023-21659 — CVSS 7.5 (high): Transient DOS in WLAN Firmware while processing frames with missing header fields.
• CVE-2023-21660 — CVSS 7.5 (high): Transient DOS in WLAN Firmware while parsing FT Information Elements.
• CVE-2023-21661 — CVSS 7.5 (high): Transient DOS while parsing WLAN beacon or probe-response frame.
• CVE-2022-22060 — CVSS 7.5 (high): Assertion occurs while processing Reconfiguration message due to improper validation
• CVE-2023-33026 — CVSS 7.5 (high): Transient DOS in WLAN Firmware while parsing a NAN management frame.
• CVE-2023-33027 — CVSS 7.5 (high): Transient DOS in WLAN Firmware while parsing rsn ies.
• CVE-2023-33041 — CVSS 7.5 (high): Under certain scenarios the WLAN Firmware will reach an assertion due to state confusion while looking up peer ids.
• CVE-2023-33042 — CVSS 7.5 (high): Transient DOS in Modem after RRC Setup message is received.
• CVE-2023-33043 — CVSS 7.5 (high): Transient DOS in Modem when a Beam switch request is made with a non-configured BWP.
• CVE-2023-33044 — CVSS 7.5 (high): Transient DOS in Data modem while handling TLB control messages from the Network.
• CVE-2023-33047 — CVSS 7.5 (high): Transient DOS in WLAN Firmware while parsing no-inherit IES.
• CVE-2023-33048 — CVSS 7.5 (high): Transient DOS in WLAN Firmware while parsing t2lm buffers.
• CVE-2023-33056 — CVSS 7.5 (high): Transient DOS in WLAN Firmware when firmware receives beacon including T2LM IE.
• CVE-2023-33061 — CVSS 7.5 (high): Transient DOS in WLAN Firmware while parsing WLAN beacon or probe-response frame.
• CVE-2023-33080 — CVSS 7.5 (high): Transient DOS while parsing a vender specific IE (Information Element) of reassociation response management frame.
• CVE-2023-33081 — CVSS 7.5 (high): Transient DOS while converting TWT (Target Wake Time) frame parameters in the OTA broadcast.
• CVE-2022-33273 — CVSS 7.3 (high): Information disclosure due to buffer over-read in Trusted Execution Environment while QRKS report generation.
• CVE-2022-22076 — CVSS 7.1 (high): information disclosure due to cryptographic issue in Core during RPMB read request.
• CVE-2022-40523 — CVSS 7.1 (high): Information disclosure in Kernel due to indirect branch misprediction.
• CVE-2022-40529 — CVSS 7.1 (high): Memory corruption due to improper access control in kernel while processing a mapping request from root process.
• CVE-2022-33302 — CVSS 6.8 (medium): Memory corruption due to improper validation of array index in User Identity Module when APN TLV length is greater than command length.
• CVE-2022-33289 — CVSS 6.8 (medium): Memory corruption occurs in Modem due to improper validation of array index when malformed APDU is sent from card.
• CVE-2022-33267 — CVSS 6.7 (medium): Memory corruption in Linux while sending DRM request.
• CVE-2022-33298 — CVSS 6.7 (medium): Memory corruption due to use after free in Modem while modem initialization.
• CVE-2022-33227 — CVSS 6.7 (medium): Memory corruption in Linux android due to double free while calling unregister provider after register call.
• CVE-2022-33224 — CVSS 6.7 (medium): Memory corruption in core due to buffer copy without check9ing the size of input while processing ioctl queries.
• CVE-2023-33024 — CVSS 6.7 (medium): Memory corruption while sending SMS from AP firmware.
• CVE-2022-33281 — CVSS 6.7 (medium): Memory corruption due to improper validation of array index in computer vision while testing EVA kernel without sending any frames.
• CVE-2022-33226 — CVSS 6.7 (medium): Memory corruption due to buffer copy without checking the size of input in Core while processing ioctl commands from diag client…
• CVE-2022-33263 — CVSS 6.7 (medium): Memory corruption due to use after free in Core when multiple DCI clients register and deregister.
• CVE-2022-40533 — CVSS 6.2 (medium): Transient DOS due to untrusted Pointer Dereference in core while sending USB QMI request.
• CVE-2023-28571 — CVSS 6.1 (medium): Information disclosure in WLAN HOST while processing the WLAN scan descriptor list during roaming scan.
• CVE-2022-33296 — CVSS 5.9 (medium): Memory corruption due to integer overflow to buffer overflow in Modem while parsing Traffic Channel Neighbor List Update message.
• CVE-2022-33303 — CVSS 5.5 (medium): Transient DOS due to uncontrolled resource consumption in Linux kernel when malformed messages are sent from the Gunyah Resource Manager…