Vulnerability identifier: #VU67042
Vulnerability risk: Low
CVSSv3.1: 6.2 [CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N/E:U/RL:O/RC:C]
CVE-ID:
CWE-ID:
CWE-287
Exploitation vector: Local
Exploit availability: No
Vulnerable software:
CSR8811
Mobile applications /
Mobile firmware & hardware
IPQ5010
Mobile applications /
Mobile firmware & hardware
IPQ5018
Mobile applications /
Mobile firmware & hardware
IPQ5028
Mobile applications /
Mobile firmware & hardware
IPQ6000
Mobile applications /
Mobile firmware & hardware
IPQ6005
Mobile applications /
Mobile firmware & hardware
IPQ6010
Mobile applications /
Mobile firmware & hardware
IPQ6018
Mobile applications /
Mobile firmware & hardware
IPQ6028
Mobile applications /
Mobile firmware & hardware
IPQ8070
Mobile applications /
Mobile firmware & hardware
IPQ8070A
Mobile applications /
Mobile firmware & hardware
IPQ8071
Mobile applications /
Mobile firmware & hardware
IPQ8071A
Mobile applications /
Mobile firmware & hardware
IPQ8072
Mobile applications /
Mobile firmware & hardware
IPQ8072A
Mobile applications /
Mobile firmware & hardware
IPQ8074A
Mobile applications /
Mobile firmware & hardware
IPQ8076
Mobile applications /
Mobile firmware & hardware
IPQ8076A
Mobile applications /
Mobile firmware & hardware
IPQ8078
Mobile applications /
Mobile firmware & hardware
IPQ8078A
Mobile applications /
Mobile firmware & hardware
IPQ8173
Mobile applications /
Mobile firmware & hardware
IPQ8174
Mobile applications /
Mobile firmware & hardware
PMP8074
Mobile applications /
Mobile firmware & hardware
QCA4024
Mobile applications /
Mobile firmware & hardware
QCA6428
Mobile applications /
Mobile firmware & hardware
QCA6438
Mobile applications /
Mobile firmware & hardware
QCA8072
Mobile applications /
Mobile firmware & hardware
QCA8075
Mobile applications /
Mobile firmware & hardware
QCA8081
Mobile applications /
Mobile firmware & hardware
QCA9888
Mobile applications /
Mobile firmware & hardware
QCA9889
Mobile applications /
Mobile firmware & hardware
QCN5021
Mobile applications /
Mobile firmware & hardware
QCN5022
Mobile applications /
Mobile firmware & hardware
QCN5024
Mobile applications /
Mobile firmware & hardware
QCN5052
Mobile applications /
Mobile firmware & hardware
QCN5054
Mobile applications /
Mobile firmware & hardware
QCN5064
Mobile applications /
Mobile firmware & hardware
QCN5121
Mobile applications /
Mobile firmware & hardware
QCN5122
Mobile applications /
Mobile firmware & hardware
QCN5124
Mobile applications /
Mobile firmware & hardware
QCN5152
Mobile applications /
Mobile firmware & hardware
QCN5154
Mobile applications /
Mobile firmware & hardware
QCN5164
Mobile applications /
Mobile firmware & hardware
QCN5550
Mobile applications /
Mobile firmware & hardware
QCN6023
Mobile applications /
Mobile firmware & hardware
QCN6024
Mobile applications /
Mobile firmware & hardware
QCN6100
Mobile applications /
Mobile firmware & hardware
QCN6102
Mobile applications /
Mobile firmware & hardware
QCN6112
Mobile applications /
Mobile firmware & hardware
QCN6122
Mobile applications /
Mobile firmware & hardware
QCN9000
Mobile applications /
Mobile firmware & hardware
QCN9012
Mobile applications /
Mobile firmware & hardware
QCN9022
Mobile applications /
Mobile firmware & hardware
QCN9024
Mobile applications /
Mobile firmware & hardware
QCN9070
Mobile applications /
Mobile firmware & hardware
QCN9072
Mobile applications /
Mobile firmware & hardware
QCN9074
Mobile applications /
Mobile firmware & hardware
QCN9100
Mobile applications /
Mobile firmware & hardware
IPQ8074
Hardware solutions /
Firmware
QCN6132
Hardware solutions /
Firmware
Vendor: Qualcomm
Description
The vulnerability allows a local application to bypass authentication process.
The vulnerability exists due to improper hash verification in WIN CoreBSP implementation. A local application can bypass authentication process and escalate privileges on the system.
Mitigation
Install updates from vendor's website.
Vulnerable software versions
CSR8811: All versions
IPQ5010: All versions
IPQ5018: All versions
IPQ5028: All versions
IPQ6000: All versions
IPQ6005: All versions
IPQ6010: All versions
IPQ6018: All versions
IPQ6028: All versions
IPQ8070: All versions
IPQ8070A: All versions
IPQ8071: All versions
IPQ8071A: All versions
IPQ8072: All versions
IPQ8072A: All versions
IPQ8074: All versions
IPQ8074A: All versions
IPQ8076: All versions
IPQ8076A: All versions
IPQ8078: All versions
IPQ8078A: All versions
IPQ8173: All versions
IPQ8174: All versions
PMP8074: All versions
QCA4024: All versions
QCA6428: All versions
QCA6438: All versions
QCA8072: All versions
QCA8075: All versions
QCA8081: All versions
QCA9888: All versions
QCA9889: All versions
QCN5021: All versions
QCN5022: All versions
QCN5024: All versions
QCN5052: All versions
QCN5054: All versions
QCN5064: All versions
QCN5121: All versions
QCN5122: All versions
QCN5124: All versions
QCN5152: All versions
QCN5154: All versions
QCN5164: All versions
QCN5550: All versions
QCN6023: All versions
QCN6024: All versions
QCN6100: All versions
QCN6102: All versions
QCN6112: All versions
QCN6122: All versions
QCN6132: All versions
QCN9000: All versions
QCN9012: All versions
QCN9022: All versions
QCN9024: All versions
QCN9070: All versions
QCN9072: All versions
QCN9074: All versions
QCN9100: All versions
External links
http://docs.qualcomm.com/product/publicresources/securitybulletin/september-2022-bulletin.html
Can this vulnerability be exploited remotely?
No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.
Is there known malware, which exploits this vulnerability?
No. We are not aware of malware exploiting this vulnerability.