Qca6426 Firmware
by Qualcomm
CVEs (681)
| CVE | Vendor / Product | Sev | Risk | CVSS | EPSS | KEV | Published | Description |
|---|---|---|---|---|---|---|---|---|
| CVE-2025-21429 | Hig | 0.49 | 7.5 | 0.00 | Apr 7, 2025 | Memory corruption occurs while connecting a STA to an AP and initiating an ADD TS request. | ||
| CVE-2024-33058 | Hig | 0.49 | 7.5 | 0.00 | Apr 7, 2025 | Memory corruption while assigning memory from the source DDR memory(HLOS) to ADSP. | ||
| CVE-2024-53027 | Hig | 0.49 | 7.5 | 0.00 | Mar 3, 2025 | Transient DOS may occur while processing the country IE. | ||
| CVE-2024-33069 | Hig | 0.49 | 7.5 | 0.00 | Oct 7, 2024 | Transient DOS when transmission of management frame sent by host is not successful and error status is received in the host. | ||
| CVE-2024-33051 | Hig | 0.49 | 7.5 | 0.00 | Sep 2, 2024 | Transient DOS while processing TIM IE from beacon frame as there is no check for IE length. | ||
| CVE-2024-33048 | Hig | 0.49 | 7.5 | 0.00 | Sep 2, 2024 | Transient DOS while parsing the received TID-to-link mapping element of beacon/probe response frame. | ||
| CVE-2024-23364 | Hig | 0.49 | 7.5 | 0.00 | Sep 2, 2024 | Transient DOS when processing the non-transmitted BSSID profile sub-elements present within the MBSSID Information Element (IE) of a beacon frame that is received from over-the-air (OTA). | ||
| CVE-2024-33025 | Hig | 0.49 | 7.5 | 0.00 | Aug 5, 2024 | Transient DOS while parsing the BSS parameter change count or MLD capabilities fields of the ML IE. | ||
| CVE-2024-33024 | Hig | 0.49 | 7.5 | 0.00 | Aug 5, 2024 | Transient DOS while parsing the ML IE when a beacon with length field inside the common info of ML IE greater than the ML IE length. | ||
| CVE-2024-33020 | Hig | 0.49 | 7.5 | 0.00 | Aug 5, 2024 | Transient DOS while processing TID-to-link mapping IE elements. | ||
| CVE-2024-33014 | Hig | 0.49 | 7.5 | 0.00 | Aug 5, 2024 | Transient DOS while parsing ESP IE from beacon/probe response frame. | ||
| CVE-2024-23353 | Hig | 0.49 | 7.5 | 0.00 | Aug 5, 2024 | Transient DOS while decoding attach reject message received by UE, when IEI is set to ESM_IEI. | ||
| CVE-2024-23352 | Hig | 0.49 | 7.5 | 0.00 | Aug 5, 2024 | Transient DOS when NAS receives ODAC criteria of length 1 and type 1 in registration accept OTA. | ||
| CVE-2024-21479 | Hig | 0.49 | 7.5 | 0.00 | Aug 5, 2024 | Transient DOS during music playback of ALAC content. | ||
| CVE-2023-43529 | Hig | 0.49 | 7.5 | 0.00 | May 6, 2024 | Transient DOS while processing IKEv2 Informational request messages, when a malformed fragment packet is received. | ||
| CVE-2023-33101 | Hig | 0.49 | 7.5 | 0.00 | Apr 1, 2024 | Transient DOS while processing DL NAS TRANSPORT message with payload length 0. | ||
| CVE-2023-33099 | Hig | 0.49 | 7.5 | 0.00 | Apr 1, 2024 | Transient DOS while processing SMS container of non-standard size received in DL NAS transport in NR. | ||
| CVE-2023-43539 | Hig | 0.49 | 7.5 | 0.00 | Mar 4, 2024 | Transient DOS while processing an improperly formatted 802.11az Fine Time Measurement protocol frame. | ||
| CVE-2023-33104 | Hig | 0.49 | 7.5 | 0.00 | Mar 4, 2024 | Transient DOS while processing PDU Release command with a parameter PDU ID out of range. | ||
| CVE-2023-33096 | Hig | 0.49 | 7.5 | 0.00 | Mar 4, 2024 | Transient DOS while processing DL NAS Transport message, as specified in 3GPP 24.501 v16. |
- risk 0.49cvss 7.5epss 0.00
Memory corruption occurs while connecting a STA to an AP and initiating an ADD TS request.
- risk 0.49cvss 7.5epss 0.00
Memory corruption while assigning memory from the source DDR memory(HLOS) to ADSP.
- risk 0.49cvss 7.5epss 0.00
Transient DOS may occur while processing the country IE.
- risk 0.49cvss 7.5epss 0.00
Transient DOS when transmission of management frame sent by host is not successful and error status is received in the host.
- risk 0.49cvss 7.5epss 0.00
Transient DOS while processing TIM IE from beacon frame as there is no check for IE length.
- risk 0.49cvss 7.5epss 0.00
Transient DOS while parsing the received TID-to-link mapping element of beacon/probe response frame.
- risk 0.49cvss 7.5epss 0.00
Transient DOS when processing the non-transmitted BSSID profile sub-elements present within the MBSSID Information Element (IE) of a beacon frame that is received from over-the-air (OTA).
- risk 0.49cvss 7.5epss 0.00
Transient DOS while parsing the BSS parameter change count or MLD capabilities fields of the ML IE.
- risk 0.49cvss 7.5epss 0.00
Transient DOS while parsing the ML IE when a beacon with length field inside the common info of ML IE greater than the ML IE length.
- risk 0.49cvss 7.5epss 0.00
Transient DOS while processing TID-to-link mapping IE elements.
- risk 0.49cvss 7.5epss 0.00
Transient DOS while parsing ESP IE from beacon/probe response frame.
- risk 0.49cvss 7.5epss 0.00
Transient DOS while decoding attach reject message received by UE, when IEI is set to ESM_IEI.
- risk 0.49cvss 7.5epss 0.00
Transient DOS when NAS receives ODAC criteria of length 1 and type 1 in registration accept OTA.
- risk 0.49cvss 7.5epss 0.00
Transient DOS during music playback of ALAC content.
- risk 0.49cvss 7.5epss 0.00
Transient DOS while processing IKEv2 Informational request messages, when a malformed fragment packet is received.
- risk 0.49cvss 7.5epss 0.00
Transient DOS while processing DL NAS TRANSPORT message with payload length 0.
- risk 0.49cvss 7.5epss 0.00
Transient DOS while processing SMS container of non-standard size received in DL NAS transport in NR.
- risk 0.49cvss 7.5epss 0.00
Transient DOS while processing an improperly formatted 802.11az Fine Time Measurement protocol frame.
- risk 0.49cvss 7.5epss 0.00
Transient DOS while processing PDU Release command with a parameter PDU ID out of range.
- risk 0.49cvss 7.5epss 0.00
Transient DOS while processing DL NAS Transport message, as specified in 3GPP 24.501 v16.
Page 19 of 35