Qcs610 Firmware
by Qualcomm
CVEs (537)
| CVE | Vendor / Product | Sev | Risk | CVSS | EPSS | KEV | Published | Description |
|---|---|---|---|---|---|---|---|---|
| CVE-2024-53013 | Med | 0.43 | 6.6 | 0.00 | Jun 3, 2025 | Memory corruption may occur while processing voice call registration with user. | ||
| CVE-2024-45570 | Med | 0.43 | 6.6 | 0.00 | May 6, 2025 | Memory corruption may occur during IO configuration processing when the IO port count is invalid. | ||
| CVE-2024-45562 | Med | 0.43 | 6.6 | 0.00 | May 6, 2025 | Memory corruption during concurrent access to server info object due to unprotected critical field. | ||
| CVE-2024-45543 | Med | 0.43 | 6.6 | 0.00 | Apr 7, 2025 | Memory corruption while accessing MSM channel map and mixer functions. | ||
| CVE-2024-45540 | Med | 0.43 | 6.6 | 0.00 | Apr 7, 2025 | Memory corruption while invoking IOCTL map buffer request from userspace. | ||
| CVE-2023-28539 | Med | 0.43 | 6.6 | 0.00 | Oct 3, 2023 | Memory corruption in WLAN Host when the firmware invokes multiple WMI Service Available command. | ||
| CVE-2025-21465 | Med | 0.42 | 6.5 | 0.00 | Aug 6, 2025 | Information disclosure while processing the hash segment in an MBN file. | ||
| CVE-2025-21464 | Med | 0.42 | 6.5 | 0.00 | Aug 6, 2025 | Information disclosure while reading data from an image using specified offset and size parameters. | ||
| CVE-2023-21667 | Med | 0.42 | 6.5 | 0.00 | Sep 5, 2023 | Transient DOS in Bluetooth HOST while passing descriptor to validate the blacklisted BT keyboard. | ||
| CVE-2023-28576 | Med | 0.42 | 6.4 | 0.00 | Aug 8, 2023 | The buffer obtained from kernel APIs such as cam_mem_get_cpu_buf() may be readable/writable in userspace after kernel accesses it. In other words, user mode may race and modify the packet header (e.g. header.count), causing checks (e.g. size checks) in kernel code to be invalid.… | ||
| CVE-2023-21647 | Med | 0.42 | 6.5 | 0.00 | Aug 8, 2023 | Information disclosure in Bluetooth when an GATT packet is received due to improper input validation. | ||
| CVE-2021-30348 | Med | 0.42 | 6.5 | 0.00 | Jan 3, 2022 | Improper validation of LLM utility timers availability can lead to denial of service in Snapdragon Auto, Snapdragon Compute, Snapdragon Connectivity, Snapdragon Consumer Electronics Connectivity, Snapdragon Consumer IOT, Snapdragon Industrial IOT, Snapdragon Mobile, Snapdragon… | ||
| CVE-2021-1960 | Med | 0.42 | 6.5 | 0.00 | Sep 9, 2021 | Improper handling of ASB-C broadcast packets with crafted opcode in LMP can lead to uncontrolled resource consumption in Snapdragon Auto, Snapdragon Compute, Snapdragon Connectivity, Snapdragon Consumer Electronics Connectivity, Snapdragon Consumer IOT, Snapdragon Industrial… | ||
| CVE-2021-1957 | Med | 0.42 | 6.5 | 0.00 | Sep 9, 2021 | Improper Access Control when ACL link encryption is failed and ACL link is not disconnected during reconnection with paired device in Snapdragon Auto, Snapdragon Compute, Snapdragon Connectivity, Snapdragon Industrial IOT, Snapdragon Mobile, Snapdragon Voice & Music | ||
| CVE-2025-27030 | Med | 0.40 | 6.1 | 0.00 | Sep 24, 2025 | information disclosure while invoking calibration data from user space to update firmware size. | ||
| CVE-2024-38417 | Med | 0.40 | 6.1 | 0.00 | Feb 3, 2025 | Information disclosure while processing IO control commands. | ||
| CVE-2024-38416 | Med | 0.40 | 6.1 | 0.00 | Feb 3, 2025 | Information disclosure during audio playback. | ||
| CVE-2024-33067 | Med | 0.40 | 6.1 | 0.00 | Jan 6, 2025 | Information disclosure while invoking callback function of sound model driver from ADSP for every valid opcode received from sound model driver. | ||
| CVE-2024-33037 | Med | 0.40 | 6.1 | 0.00 | Dec 2, 2024 | Information disclosure as NPU firmware can send invalid IPC message to NPU driver as the driver doesn`t validate the IPC message received from the firmware. | ||
| CVE-2023-43528 | Med | 0.40 | 6.1 | 0.00 | May 6, 2024 | Information disclosure when the ADSP payload size received in HLOS in response to Audio Stream Manager matrix session is less than this expected size. |
- risk 0.43cvss 6.6epss 0.00
Memory corruption may occur while processing voice call registration with user.
- risk 0.43cvss 6.6epss 0.00
Memory corruption may occur during IO configuration processing when the IO port count is invalid.
- risk 0.43cvss 6.6epss 0.00
Memory corruption during concurrent access to server info object due to unprotected critical field.
- risk 0.43cvss 6.6epss 0.00
Memory corruption while accessing MSM channel map and mixer functions.
- risk 0.43cvss 6.6epss 0.00
Memory corruption while invoking IOCTL map buffer request from userspace.
- risk 0.43cvss 6.6epss 0.00
Memory corruption in WLAN Host when the firmware invokes multiple WMI Service Available command.
- risk 0.42cvss 6.5epss 0.00
Information disclosure while processing the hash segment in an MBN file.
- risk 0.42cvss 6.5epss 0.00
Information disclosure while reading data from an image using specified offset and size parameters.
- risk 0.42cvss 6.5epss 0.00
Transient DOS in Bluetooth HOST while passing descriptor to validate the blacklisted BT keyboard.
- risk 0.42cvss 6.4epss 0.00
The buffer obtained from kernel APIs such as cam_mem_get_cpu_buf() may be readable/writable in userspace after kernel accesses it. In other words, user mode may race and modify the packet header (e.g. header.count), causing checks (e.g. size checks) in kernel code to be invalid.…
- risk 0.42cvss 6.5epss 0.00
Information disclosure in Bluetooth when an GATT packet is received due to improper input validation.
- risk 0.42cvss 6.5epss 0.00
Improper validation of LLM utility timers availability can lead to denial of service in Snapdragon Auto, Snapdragon Compute, Snapdragon Connectivity, Snapdragon Consumer Electronics Connectivity, Snapdragon Consumer IOT, Snapdragon Industrial IOT, Snapdragon Mobile, Snapdragon…
- risk 0.42cvss 6.5epss 0.00
Improper handling of ASB-C broadcast packets with crafted opcode in LMP can lead to uncontrolled resource consumption in Snapdragon Auto, Snapdragon Compute, Snapdragon Connectivity, Snapdragon Consumer Electronics Connectivity, Snapdragon Consumer IOT, Snapdragon Industrial…
- risk 0.42cvss 6.5epss 0.00
Improper Access Control when ACL link encryption is failed and ACL link is not disconnected during reconnection with paired device in Snapdragon Auto, Snapdragon Compute, Snapdragon Connectivity, Snapdragon Industrial IOT, Snapdragon Mobile, Snapdragon Voice & Music
- risk 0.40cvss 6.1epss 0.00
information disclosure while invoking calibration data from user space to update firmware size.
- risk 0.40cvss 6.1epss 0.00
Information disclosure while processing IO control commands.
- risk 0.40cvss 6.1epss 0.00
Information disclosure during audio playback.
- risk 0.40cvss 6.1epss 0.00
Information disclosure while invoking callback function of sound model driver from ADSP for every valid opcode received from sound model driver.
- risk 0.40cvss 6.1epss 0.00
Information disclosure as NPU firmware can send invalid IPC message to NPU driver as the driver doesn`t validate the IPC message received from the firmware.
- risk 0.40cvss 6.1epss 0.00
Information disclosure when the ADSP payload size received in HLOS in response to Audio Stream Manager matrix session is less than this expected size.
Page 25 of 27