PT-2020-17597 · Qualcomm · Snapdragon Wearables+5

Published 2020-06-22 · Updated 2020-06-25 · CVE-2020-3626

Positive Technologies (AI Summary)

CVSS v2.0

4.6

Medium

Base vector

AV:L/AC:L/Au:N/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions Qualcomm Snapdragon versions APQ8053 through SM8250

Description The issue is related to a lack of protection for the AIDL uimlpaservice in various Qualcomm Snapdragon products, including Snapdragon Auto, Snapdragon Compute, Snapdragon Consumer IOT, Snapdragon Industrial IOT, Snapdragon Mobile, and Snapdragon Wearables. This allows any application to bind to it and exercise the APIs.

Recommendations For versions APQ8053 through SM8250, as a temporary workaround, consider restricting access to the vulnerable AIDL uimlpaservice until a patch is available. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Incorrect Default Permissions

Weakness Enumeration

CWE-276

Related Identifiers

CVE-2020-3626

Affected Products

Snapdragon Auto

Snapdragon Compute

Snapdragon Consumer Iot

Snapdragon Industrial Iot

Snapdragon Mobile

Snapdragon Wearables

References · 4

• https://qualcomm.com/company/product-security/bulletins/june-2020-security-bulletin · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2020-3626 · Security Note
• https://t.me/cvenotify/4553 · Telegram Post
• https://qualcomm.com/company/product-security/bulletins/june-2020-bulletin · Note