High severity · published Oct 23, 2018
CVE-2017-18295
Possible buffer overflow if input is not null terminated in DSP Service module in Snapdragon Automobile, Snapdragon Mobile, Snapdragon Wear in version MDM9206, MDM9607, MDM9650,…
7.8
CVSS
0.3%
EPSS
No
On KEV
Description
Possible buffer overflow if input is not null terminated in DSP Service module in Snapdragon Automobile, Snapdragon Mobile, Snapdragon Wear in version MDM9206, MDM9607, MDM9650, MSM8909W, MSM8996AU, SD 210/SD 212/SD 205, SD 450, SD 615/16/SD 415, SD 625, SD 650/52, SD 820, SD 820A, SD 835, SDX20.
CVSS vector
CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Attack vector
Local
Complexity
Low
Privileges
Low
User interaction
None
Confidentiality
High
Integrity
High
Availability
High
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)0.3% · higher than 21% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
MF
Mdm9206 Firmware · Qualcomm
All versions, or not specified · source: NVD
MF
Mdm9607 Firmware · Qualcomm
All versions, or not specified · source: NVD
MF
Mdm9650 Firmware · Qualcomm
All versions, or not specified · source: NVD
MF
Msm8909w Firmware · Qualcomm
All versions, or not specified · source: NVD
MF
Msm8996au Firmware · Qualcomm
All versions, or not specified · source: NVD
S2
SD 205 Firmware · Qualcomm
All versions, or not specified · source: NVD
S2
SD 210 Firmware · Qualcomm
All versions, or not specified · source: NVD
S2
SD 212 Firmware · Qualcomm
All versions, or not specified · source: NVD
S4
SD 415 Firmware · Qualcomm
All versions, or not specified · source: NVD
S4
SD 450 Firmware · Qualcomm
All versions, or not specified · source: NVD
S6
SD 615 Firmware · Qualcomm
All versions, or not specified · source: NVD
S6
SD 616 Firmware · Qualcomm
All versions, or not specified · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2017-18295
CVE.org
https://www.cve.org/CVERecord?id=CVE-2017-18295
Third Party Advisory
http://www.securitytracker.com/id/1041432
Third Party Advisory
https://source.android.com/security/bulletin/2018-08-01#qualcomm-closed-source-components
Vendor Advisory
https://www.qualcomm.com/company/product-security/bulletins
More from Mdm9206 Firmware
7.8
CVE-2021-1905
Qualcomm Multiple Chipsets Use-After-Free Vulnerability
5.5
CVE-2021-1906
Qualcomm Multiple Chipsets Detection of Error Condition Without Action Vulnerability
9.8
CVE-2022-40510
Buffer copy without checking size of input in Audio.
9.8
CVE-2022-33259
Buffer copy without checking the size of input in Modem
9.8
CVE-2022-33211
Improper Input Validation in MODEM