Improper Access Control in Qualcomm products - CVE-2022-40539

Vulnerability identifier: #VU72837

CSH Severity: Low

CVSS v4: 8.5 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

CVE-ID: CVE-2022-40539

CWE-ID: CWE-284

Exploitation vector: Local access

Exploit availability: No public exploit available

The vulnerability allows a local application to execute arbitrary code.

The vulnerability exists due to improper input validation in Automotive Android OS. A local application can execute arbitrary code.

SA8195P
WSA8835
WSA8830
WSA8815
WSA8810
WCN3988
WCN3980
WCN3950
WCD9370
WCD9341
SW5100P
SW5100
SA8295P
QAM8295P
SA8155P
SA8150P
SA8145P
SA6150P
SA6145P
QCS610
QCS410
QCC5100
QCA6696
SA6155P
QCA6574AU

Install security update from vendor's website.

• https://docs.qualcomm.com/product/publicresources/securitybulletin/march-2023-bulletin.html

• Multiple vulnerabilities in Qualcomm chipsets