Buffer overflow in Qualcomm products - CVE-2022-25708

Vulnerability identifier: #VU67043

CSH Severity: Medium

CVSS v4.0: CVSS:4.0/AV:A/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:U/U:Green

CVE-ID: CVE-2022-25708

CWE-ID: CWE-119

Exploitation vector: Adjecent network

Exploit availability: No public exploit available

Vendor: Qualcomm

Affected software:
SD 8 Gen1 5G
SD888 5G
WCD9370
WCD9375
WCD9380
WCD9385
WCN6750
WCN6850
WCN6851
WCN6855
WCN6856
WCN7850
WCN7851
WSA8830
WSA8835
SM7450
WSA8832

The vulnerability allows a remote attacker to execute arbitrary code on the target system.

The vulnerability exists due to a boundary error in WLAN Firmware when processing keys. A remote attacker on the local network can send specially crafted input to the affected device, trigger memory corruption and execute arbitrary code on the target system.

Install updates from vendor's website.

• https://docs.qualcomm.com/product/publicresources/securitybulletin/september-2022-bulletin.html