PT-2020-9490 · Qualcomm · Snapdragon Industrial Iot+20

Published 2020-06-02 · Updated 2020-06-03 · CVE-2019-14066

Positive Technologies (AI Summary)

CVSS v2.0

7.2

High

Base vector

AV:L/AC:L/Au:N/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions: Qualcomm Snapdragon versions (affected versions not specified)

Description: The issue is related to an integer overflow when calculating the estimated output buffer size. This occurs when getting a list of installed Feature IDs, Serial Numbers, or checking Feature ID status in various Snapdragon products, including Snapdragon Auto, Snapdragon Compute, Snapdragon Consumer IOT, Snapdragon Industrial IOT, Snapdragon Mobile, Snapdragon Voice & Music, and Snapdragon Wired Infrastructure and Networking. The affected products include Kamorta, MDM9205, MDM9607, Nicobar, QCS404, QCS405, Rennell, SA6155P, SC7180, SC8180X, SDX55, SM6150, SM7150, and SXR2130.

Recommendations: At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Integer Overflow

Weakness Enumeration

CWE-190

Related Identifiers

CVE-2019-14066

Affected Products

Kamorta

Mdm9205

Mdm9607

Nicobar

Qcs404

Qcs405

Rennell

Sa6155P

Sc7180

Sc8180X

Sdx55

Sm6150

Sm7150

Sxr2130

Snapdragon Auto

Snapdragon Compute

Snapdragon Consumer Iot

Snapdragon Industrial Iot

Snapdragon Mobile

Snapdragon Voice & Music

Snapdragon Wired Infrastructure/Networking

References · 3

• https://qualcomm.com/company/product-security/bulletins/may-2020-bulletin · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2019-14066 · Security Note
• https://t.me/cvenotify/4110 · Telegram Post