PT-2020-16246 · Qualcomm · Qcmap

Published 2020-10-15 · Updated 2020-10-26 · CVE-2020-25858

Positive Technologies (AI Summary)

CVSS v2.0

5.0

Medium

Base vector

AV:N/AC:L/Au:N/C:N/I:N/A:P

Name of the Vulnerable Software and Affected Versions Qualcomm QCMAP software suite versions prior to October 2020

Description The issue concerns the QCMAP Web CLIENT binary in the Qualcomm QCMAP software suite. It does not validate the return value of a strstr() or strchr() call in the Tokenizer() function. An attacker can invoke the web interface with a crafted URL, potentially crashing the process and causing denial of service. This version of QCMAP is used in various networking devices, including mobile hotspots and LTE routers.

Recommendations For versions prior to October 2020, update to a version released in October 2020 or later to resolve the issue. As a temporary workaround, consider restricting access to the web interface to minimize the risk of exploitation.

Exploit

Fix

NULL Pointer Dereference

Weakness Enumeration

CWE-476

Related Identifiers

CVE-2020-25858

Affected Products

Qcmap

References · 3

• 🔥 http://vdoo.com/blog/qualcomm-qcmap-vulnerabilities · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2020-25858 · Security Note
• https://t.me/cybersecuritytechnologies/1943 · Telegram Post