Vulnerability identifier: #VU76863

Vulnerability risk: Low

CVSSv3.1: 5.7 [CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N/E:U/RL:O/RC:C]

CVE-ID: CVE-2022-40525

CWE-ID: CWE-200

Exploitation vector: Local

Exploit availability: No

Vulnerable software:
CSR8811
Mobile applications / Mobile firmware & hardware
IPQ6000
Mobile applications / Mobile firmware & hardware
IPQ6005
Mobile applications / Mobile firmware & hardware
IPQ6010
Mobile applications / Mobile firmware & hardware
IPQ6018
Mobile applications / Mobile firmware & hardware
IPQ6028
Mobile applications / Mobile firmware & hardware
IPQ9008
Mobile applications / Mobile firmware & hardware
IPQ9574
Mobile applications / Mobile firmware & hardware
QCA4024
Mobile applications / Mobile firmware & hardware
QCA8072
Mobile applications / Mobile firmware & hardware
QCA8075
Mobile applications / Mobile firmware & hardware
QCA8081
Mobile applications / Mobile firmware & hardware
QCA8082
Mobile applications / Mobile firmware & hardware
QCA8084
Mobile applications / Mobile firmware & hardware
QCA8085
Mobile applications / Mobile firmware & hardware
QCA8386
Mobile applications / Mobile firmware & hardware
QCN5021
Mobile applications / Mobile firmware & hardware
QCN5022
Mobile applications / Mobile firmware & hardware
QCN5052
Mobile applications / Mobile firmware & hardware
QCN5121
Mobile applications / Mobile firmware & hardware
QCN5122
Mobile applications / Mobile firmware & hardware
QCN5152
Mobile applications / Mobile firmware & hardware
QCN6023
Mobile applications / Mobile firmware & hardware
QCN6024
Mobile applications / Mobile firmware & hardware
QCN9000
Mobile applications / Mobile firmware & hardware
QCN9022
Mobile applications / Mobile firmware & hardware
QCN9024
Mobile applications / Mobile firmware & hardware
QCN9070
Mobile applications / Mobile firmware & hardware
QCN9072
Mobile applications / Mobile firmware & hardware
QCN9074
Mobile applications / Mobile firmware & hardware
QCN9274
Mobile applications / Mobile firmware & hardware

Vendor: Qualcomm

Description

The vulnerability allows a local application to gain access to sensitive information.

The vulnerability exists due to improper input validation in Linux Networking Firmware. A local application can gain access to sensitive information.

Mitigation
Install security update from vendor's website.

Vulnerable software versions

CSR8811: All versions

IPQ6000: All versions

IPQ6005: All versions

IPQ6010: All versions

IPQ6018: All versions

IPQ6028: All versions

IPQ9008: All versions

IPQ9574: All versions

QCA4024: All versions

QCA8072: All versions

QCA8075: All versions

QCA8081: All versions

QCA8082: All versions

QCA8084: All versions

QCA8085: All versions

QCA8386: All versions

QCN5021: All versions

QCN5022: All versions

QCN5052: All versions

QCN5121: All versions

QCN5122: All versions

QCN5152: All versions

QCN6023: All versions

QCN6024: All versions

QCN9000: All versions

QCN9022: All versions

QCN9024: All versions

QCN9070: All versions

QCN9072: All versions

QCN9074: All versions

QCN9274: All versions

---

External links
http://docs.qualcomm.com/product/publicresources/securitybulletin/june-2023-bulletin.html

---

Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.