#VU112415 Improper Validation of Array Index in Qualcomm products - CVE-2020-3639

Vulnerability identifier: #VU112415

Vulnerability risk: High

CVSSv4.0: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:U/U:Amber

CVE-ID: CVE-2020-3639

CWE-ID: CWE-129

Exploitation vector: Remote access

Exploit availability: No public exploit available

Vulnerable software:
APQ8009
APQ8017
APQ8053
MDM9607
MDM9640
MDM9650
MSM8905
MSM8917
MSM8920
MSM8937
MSM8940
MSM8953
MSM8996AU
QCS605
QM215
SA6155P
SC8180X
SDA660
SDA845
SDM429
SDM429W
SDM439
SDM450
SDM630
SDM632
SDM636
SDM660
SDM670
SDM710
SDM845
SDX24
SDX55
SM6150
SM7150
SM8150
SXR1130
APQ8037
MDM9250
MDM9628
MSM8108
MSM8208
MSM8209
MSM8608
MSM8909
QCM4290
QCM6125
QCS410
QCS4290
QCS603
QCS610
QCS6125
QSM8350
SA415M
SA6145P
SA6150P
SA8150P
SA8155
SA8155P
SA8195P
SC7180
SC8180X+SDX55
SC8180XP
SDA429W
SDA640
SDA670
SDA855
SDM1000
SDM455
SDM640
SDM712
SDM850
SDX50M
SDX55M
SM4125
SM4250
SM4250P
SM6115
SM6115P
SM6125
SM6150P
SM6250
SM6250P
SM7125
SM7150P
SM7250
SM7250P
SM8150P
SM8350
SM8350P
SXR1120

Software vendor:
Qualcomm

The vulnerability allows a remote attacker to execute arbitrary code.

The vulnerability exists due to improper input validation in Modem Data. A remote attacker can execute arbitrary code.

Install security update from vendor's website.

• https://docs.qualcomm.com/product/publicresources/securitybulletin/november-2020-security-bulletin.html