PT-2020-12559 · Qualcomm · Snapdragon Wearables+7

Published 2020-09-08 · Updated 2021-07-21 · CVE-2020-11118

Positive Technologies (AI Summary)

CVSS v2.0

5.0

Medium

Base vector

AV:N/AC:L/Au:N/C:P/I:N/A:N

Name of the Vulnerable Software and Affected Versions Snapdragon Auto versions APQ8009 through SM8250 Snapdragon Compute versions APQ8009 through SM8250 Snapdragon Consumer Electronics Connectivity versions APQ8009 through SM8250 Snapdragon Consumer IOT versions APQ8009 through SM8250 Snapdragon Industrial IOT versions APQ8009 through SM8250 Snapdragon Mobile versions APQ8009 through SM8250 Snapdragon Voice & Music versions APQ8009 through SM8250 Snapdragon Wearables versions APQ8009 through SM8250

Description The issue is related to information exposure while processing IE header due to improper check of beacon IE frame. This affects various Snapdragon products.

Recommendations For Snapdragon Auto versions APQ8009 through SM8250, update to a version that includes the fix for the information exposure issue. For Snapdragon Compute versions APQ8009 through SM8250, update to a version that includes the fix for the information exposure issue. For Snapdragon Consumer Electronics Connectivity versions APQ8009 through SM8250, update to a version that includes the fix for the information exposure issue. For Snapdragon Consumer IOT versions APQ8009 through SM8250, update to a version that includes the fix for the information exposure issue. For Snapdragon Industrial IOT versions APQ8009 through SM8250, update to a version that includes the fix for the information exposure issue. For Snapdragon Mobile versions APQ8009 through SM8250, update to a version that includes the fix for the information exposure issue. For Snapdragon Voice & Music versions APQ8009 through SM8250, update to a version that includes the fix for the information exposure issue. For Snapdragon Wearables versions APQ8009 through SM8250, update to a version that includes the fix for the information exposure issue.

Fix

RCE

Weakness Enumeration

CWE-20

Related Identifiers

CVE-2020-11118

Affected Products

Snapdragon Auto

Snapdragon Compute

Snapdragon Consumer Electronics Connectivity

Snapdragon Consumer Iot

Snapdragon Industrial Iot

Snapdragon Mobile

Snapdragon Voice & Music

Snapdragon Wearables

References · 4

• https://qualcomm.com/company/product-security/bulletins/august-2020-security-bulletin · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2020-11118 · Security Note
• https://t.me/cibsecurity/14512 · Telegram Post
• https://qualcomm.com/company/product-security/bulletins/august-2020-bulletin · Note