Vulnerability identifier: #VU87918

Vulnerability risk: High

CVSSv3.1: 8.5 [CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C]

CVE-ID: CVE-2024-21473

CWE-ID: CWE-20

Exploitation vector: Network

Exploit availability: No

Vulnerable software:
AR8035
Mobile applications / Mobile firmware & hardware
AR9380
Mobile applications / Mobile firmware & hardware
CSR8811
Mobile applications / Mobile firmware & hardware
FastConnect 6900
Mobile applications / Mobile firmware & hardware
FastConnect 7800
Mobile applications / Mobile firmware & hardware
Immersive Home 214 Platform
Mobile applications / Mobile firmware & hardware
Immersive Home 216 Platform
Mobile applications / Mobile firmware & hardware
Immersive Home 316 Platform
Mobile applications / Mobile firmware & hardware
Immersive Home 318 Platform
Mobile applications / Mobile firmware & hardware
Immersive Home 3210 Platform
Mobile applications / Mobile firmware & hardware
Immersive Home 326 Platform
Mobile applications / Mobile firmware & hardware
IPQ4018
Mobile applications / Mobile firmware & hardware
IPQ4028
Mobile applications / Mobile firmware & hardware
IPQ4029
Mobile applications / Mobile firmware & hardware
IPQ5010
Mobile applications / Mobile firmware & hardware
IPQ5028
Mobile applications / Mobile firmware & hardware
IPQ5300
Mobile applications / Mobile firmware & hardware
IPQ5302
Mobile applications / Mobile firmware & hardware
IPQ5312
Mobile applications / Mobile firmware & hardware
IPQ5332
Mobile applications / Mobile firmware & hardware
IPQ6000
Mobile applications / Mobile firmware & hardware
IPQ6010
Mobile applications / Mobile firmware & hardware
IPQ6018
Mobile applications / Mobile firmware & hardware
IPQ6028
Mobile applications / Mobile firmware & hardware
IPQ8065
Mobile applications / Mobile firmware & hardware
IPQ8068
Mobile applications / Mobile firmware & hardware
IPQ8070
Mobile applications / Mobile firmware & hardware
IPQ8070A
Mobile applications / Mobile firmware & hardware
IPQ8071
Mobile applications / Mobile firmware & hardware
IPQ8071A
Mobile applications / Mobile firmware & hardware
IPQ8072
Mobile applications / Mobile firmware & hardware
IPQ8072A
Mobile applications / Mobile firmware & hardware
IPQ8074A
Mobile applications / Mobile firmware & hardware
IPQ8076
Mobile applications / Mobile firmware & hardware
IPQ8076A
Mobile applications / Mobile firmware & hardware
IPQ8078
Mobile applications / Mobile firmware & hardware
IPQ8078A
Mobile applications / Mobile firmware & hardware
IPQ8173
Mobile applications / Mobile firmware & hardware
IPQ8174
Mobile applications / Mobile firmware & hardware
IPQ9008
Mobile applications / Mobile firmware & hardware
IPQ9554
Mobile applications / Mobile firmware & hardware
IPQ9570
Mobile applications / Mobile firmware & hardware
IPQ9574
Mobile applications / Mobile firmware & hardware
PMP8074
Mobile applications / Mobile firmware & hardware
QCA0000
Mobile applications / Mobile firmware & hardware
QCA4024
Mobile applications / Mobile firmware & hardware
QCA6428
Mobile applications / Mobile firmware & hardware
QCA6438
Mobile applications / Mobile firmware & hardware
QCA7500
Mobile applications / Mobile firmware & hardware
QCA8072
Mobile applications / Mobile firmware & hardware
QCA8075
Mobile applications / Mobile firmware & hardware
QCA8081
Mobile applications / Mobile firmware & hardware
QCA8082
Mobile applications / Mobile firmware & hardware
QCA8084
Mobile applications / Mobile firmware & hardware
QCA8085
Mobile applications / Mobile firmware & hardware
QCA8337
Mobile applications / Mobile firmware & hardware
QCA8386
Mobile applications / Mobile firmware & hardware
QCA9563
Mobile applications / Mobile firmware & hardware
QCA9880
Mobile applications / Mobile firmware & hardware
QCA9886
Mobile applications / Mobile firmware & hardware
QCA9888
Mobile applications / Mobile firmware & hardware
QCA9889
Mobile applications / Mobile firmware & hardware
QCA9898
Mobile applications / Mobile firmware & hardware
QCA9984
Mobile applications / Mobile firmware & hardware
QCA9985
Mobile applications / Mobile firmware & hardware
QCA9986
Mobile applications / Mobile firmware & hardware
QCA9988
Mobile applications / Mobile firmware & hardware
QCA9990
Mobile applications / Mobile firmware & hardware
QCA9992
Mobile applications / Mobile firmware & hardware
QCA9994
Mobile applications / Mobile firmware & hardware
QCC710
Mobile applications / Mobile firmware & hardware
QCF8000
Mobile applications / Mobile firmware & hardware
QCF8001
Mobile applications / Mobile firmware & hardware
QCN5021
Mobile applications / Mobile firmware & hardware
QCN5022
Mobile applications / Mobile firmware & hardware
QCN5024
Mobile applications / Mobile firmware & hardware
QCN5052
Mobile applications / Mobile firmware & hardware
QCN5054
Mobile applications / Mobile firmware & hardware
QCN5064
Mobile applications / Mobile firmware & hardware
QCN5122
Mobile applications / Mobile firmware & hardware
QCN5124
Mobile applications / Mobile firmware & hardware
QCN5152
Mobile applications / Mobile firmware & hardware
QCN5154
Mobile applications / Mobile firmware & hardware
QCN5164
Mobile applications / Mobile firmware & hardware
QCN5502
Mobile applications / Mobile firmware & hardware
QCN5550
Mobile applications / Mobile firmware & hardware
QCN6023
Mobile applications / Mobile firmware & hardware
QCN6024
Mobile applications / Mobile firmware & hardware
QCN6100
Mobile applications / Mobile firmware & hardware
QCN6102
Mobile applications / Mobile firmware & hardware
QCN6112
Mobile applications / Mobile firmware & hardware
QCN6122
Mobile applications / Mobile firmware & hardware
QCN6224
Mobile applications / Mobile firmware & hardware
QCN6274
Mobile applications / Mobile firmware & hardware
QCN6402
Mobile applications / Mobile firmware & hardware
QCN6412
Mobile applications / Mobile firmware & hardware
QCN6422
Mobile applications / Mobile firmware & hardware
QCN6432
Mobile applications / Mobile firmware & hardware
QCN9000
Mobile applications / Mobile firmware & hardware
QCN9001
Mobile applications / Mobile firmware & hardware
QCN9002
Mobile applications / Mobile firmware & hardware
QCN9003
Mobile applications / Mobile firmware & hardware
QCN9012
Mobile applications / Mobile firmware & hardware
QCN9022
Mobile applications / Mobile firmware & hardware
QCN9024
Mobile applications / Mobile firmware & hardware
QCN9070
Mobile applications / Mobile firmware & hardware
QCN9072
Mobile applications / Mobile firmware & hardware
QCN9074
Mobile applications / Mobile firmware & hardware
QCN9100
Mobile applications / Mobile firmware & hardware
QCN9274
Mobile applications / Mobile firmware & hardware
QFE1922
Mobile applications / Mobile firmware & hardware
QFE1952
Mobile applications / Mobile firmware & hardware
QFW7114
Mobile applications / Mobile firmware & hardware
QFW7124
Mobile applications / Mobile firmware & hardware
SDX65M
Mobile applications / Mobile firmware & hardware
Snapdragon X65 5G Modem-RF System
Mobile applications / Mobile firmware & hardware
Snapdragon X75 5G Modem-RF System
Mobile applications / Mobile firmware & hardware
WCD9340
Mobile applications / Mobile firmware & hardware
WCD9380
Mobile applications / Mobile firmware & hardware
IPQ4019
Hardware solutions / Firmware
IPQ8064
Hardware solutions / Firmware
IPQ8074
Hardware solutions / Firmware
QCA9531
Hardware solutions / Firmware
QCA9558
Hardware solutions / Firmware
QCA9980
Hardware solutions / Firmware
QCN6132
Hardware solutions / Firmware
SDX55
Hardware solutions / Firmware

Vendor: Qualcomm

Description

The vulnerability allows a remote attacker to execute arbitrary code.

The vulnerability exists due to improper input validation in WIN SON. A remote attacker can execute arbitrary code.

Mitigation
Install security update from vendor's website.

Vulnerable software versions

AR8035: All versions

AR9380: All versions

CSR8811: All versions

FastConnect 6900: All versions

FastConnect 7800: All versions

Immersive Home 214 Platform: All versions

Immersive Home 216 Platform: All versions

Immersive Home 316 Platform: All versions

Immersive Home 318 Platform: All versions

Immersive Home 3210 Platform: All versions

Immersive Home 326 Platform: All versions

IPQ4018: All versions

IPQ4019: All versions

IPQ4028: All versions

IPQ4029: All versions

IPQ5010: All versions

IPQ5028: All versions

IPQ5300: All versions

IPQ5302: All versions

IPQ5312: All versions

IPQ5332: All versions

IPQ6000: All versions

IPQ6010: All versions

IPQ6018: All versions

IPQ6028: All versions

IPQ8064: All versions

IPQ8065: All versions

IPQ8068: All versions

IPQ8070: All versions

IPQ8070A: All versions

IPQ8071: All versions

IPQ8071A: All versions

IPQ8072: All versions

IPQ8072A: All versions

IPQ8074: All versions

IPQ8074A: All versions

IPQ8076: All versions

IPQ8076A: All versions

IPQ8078: All versions

IPQ8078A: All versions

IPQ8173: All versions

IPQ8174: All versions

IPQ9008: All versions

IPQ9554: All versions

IPQ9570: All versions

IPQ9574: All versions

PMP8074: All versions

QCA0000: All versions

QCA4024: All versions

QCA6428: All versions

QCA6438: All versions

QCA7500: All versions

QCA8072: All versions

QCA8075: All versions

QCA8081: All versions

QCA8082: All versions

QCA8084: All versions

QCA8085: All versions

QCA8337: All versions

QCA8386: All versions

QCA9531: All versions

QCA9558: All versions

QCA9563: All versions

QCA9880: All versions

QCA9886: All versions

QCA9888: All versions

QCA9889: All versions

QCA9898: All versions

QCA9980: All versions

QCA9984: All versions

QCA9985: All versions

QCA9986: All versions

QCA9988: All versions

QCA9990: All versions

QCA9992: All versions

QCA9994: All versions

QCC710: All versions

QCF8000: All versions

QCF8001: All versions

QCN5021: All versions

QCN5022: All versions

QCN5024: All versions

QCN5052: All versions

QCN5054: All versions

QCN5064: All versions

QCN5122: All versions

QCN5124: All versions

QCN5152: All versions

QCN5154: All versions

QCN5164: All versions

QCN5502: All versions

QCN5550: All versions

QCN6023: All versions

QCN6024: All versions

QCN6100: All versions

QCN6102: All versions

QCN6112: All versions

QCN6122: All versions

QCN6132: All versions

QCN6224: All versions

QCN6274: All versions

QCN6402: All versions

QCN6412: All versions

QCN6422: All versions

QCN6432: All versions

QCN9000: All versions

QCN9001: All versions

QCN9002: All versions

QCN9003: All versions

QCN9012: All versions

QCN9022: All versions

QCN9024: All versions

QCN9070: All versions

QCN9072: All versions

QCN9074: All versions

QCN9100: All versions

QCN9274: All versions

QFE1922: All versions

QFE1952: All versions

QFW7114: All versions

QFW7124: All versions

SDX55: All versions

SDX65M: All versions

Snapdragon X65 5G Modem-RF System: All versions

Snapdragon X75 5G Modem-RF System: All versions

WCD9340: All versions

WCD9380: All versions

---

External links
http://docs.qualcomm.com/product/publicresources/securitybulletin/april-2024-bulletin.html

---

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.