PT-2021-7399 · Qualcomm · Snapdragon Wearables+6

Abdullah Al Ishtiaq + 4 · Published 2021-06-15 · Updated 2023-08-08 · CVE-2022-22091

Positive Technologies (AI Summary)

CVSS v2.0

7.8

High

Base vector

AV:N/AC:L/Au:N/C:N/I:N/A:C

Name of the Vulnerable Software and Affected Versions Qualcomm Snapdragon Auto, Snapdragon Compute, Snapdragon Connectivity, Snapdragon Consumer IOT, Snapdragon Industrial IOT, Snapdragon Mobile, Snapdragon Wearables (affected versions not specified)

Description The issue is related to improper authorization of a replayed LTE security mode command, which can lead to a denial of service. This can be exploited by a remote attacker by sending specially crafted packets, potentially causing a denial of service. The vulnerability is associated with deficiencies in the authorization procedure when handling the securityModeCommand parameter in Qualcomm's LTE technology implementation.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Improper Authorization

Weakness Enumeration

CWE-285

Related Identifiers

BDU:2022-06005

CVE-2022-22091

Affected Products

Snapdragon Auto

Snapdragon Compute

Snapdragon Connectivity

Snapdragon Consumer Iot

Snapdragon Industrial Iot

Snapdragon Mobile

Snapdragon Wearables

References · 7

• https://nvd.nist.gov/vuln/detail/CVE-2022-22091 · Security Note
• https://bdu.fstec.ru/vul/2022-06005 · Security Note
• https://qualcomm.com/company/product-security/bulletins/september-2022-bulletin · Vendor Advisory
• https://cybersecurity-help.cz/vdb/SB2022090806 · Note
• https://docs.qualcomm.com/product/publicresources/securitybulletin/september-2022-bulletin.html · Note
• https://source.android.com/docs/security/bulletin/2022-09-01 · Note
• https://t.me/cibsecurity/49862 · Telegram Post