Sxr2250p Firmware
by Qualcomm
CVEs (191)
| CVE | Vendor / Product | Sev | Risk | CVSS | EPSS | KEV | Published | Description |
|---|---|---|---|---|---|---|---|---|
| CVE-2024-33019 | Hig | 0.49 | 7.5 | 0.00 | Aug 5, 2024 | Transient DOS while parsing the received TID-to-link mapping action frame. | ||
| CVE-2024-33018 | Hig | 0.49 | 7.5 | 0.00 | Aug 5, 2024 | Transient DOS while parsing the received TID-to-link mapping element of the TID-to-link mapping action frame. | ||
| CVE-2024-33015 | Hig | 0.49 | 7.5 | 0.00 | Aug 5, 2024 | Transient DOS while parsing SCAN RNR IE when bytes received from AP is such that the size of the last param of IE is less than neighbor report. | ||
| CVE-2024-33014 | Hig | 0.49 | 7.5 | 0.00 | Aug 5, 2024 | Transient DOS while parsing ESP IE from beacon/probe response frame. | ||
| CVE-2024-33013 | Hig | 0.49 | 7.5 | 0.00 | Aug 5, 2024 | Transient DOS when driver accesses the ML IE memory and offset value is incremented beyond ML IE length. | ||
| CVE-2024-33012 | Hig | 0.49 | 7.5 | 0.00 | Aug 5, 2024 | Transient DOS while parsing the multiple MBSSID IEs from the beacon, when the tag length is non-zero value but with end of beacon. | ||
| CVE-2024-33011 | Hig | 0.49 | 7.5 | 0.00 | Aug 5, 2024 | Transient DOS while parsing the MBSSID IE from the beacons, when the MBSSID IE length is zero. | ||
| CVE-2024-33010 | Hig | 0.49 | 7.5 | 0.00 | Aug 5, 2024 | Transient DOS while parsing fragments of MBSSID IE from beacon frame. | ||
| CVE-2024-21477 | Hig | 0.49 | 7.5 | 0.00 | May 6, 2024 | Transient DOS while parsing a protected 802.11az Fine Time Measurement (FTM) frame. | ||
| CVE-2026-24092 | Hig | 0.47 | 7.2 | 0.00 | Jun 1, 2026 | Memory Corruption when processing fastboot commands to set display mode. | ||
| CVE-2026-24091 | Hig | 0.47 | 7.2 | 0.00 | Jun 1, 2026 | Memory corruption while processing fastboot commands with improperly formatted input. | ||
| CVE-2026-24089 | Hig | 0.47 | 7.2 | 0.00 | Jun 1, 2026 | Memory corruption while processing fastboot commands with invalid input. | ||
| CVE-2026-24085 | Hig | 0.47 | 7.2 | 0.00 | Jun 1, 2026 | Memory Corruption when processing display command line information due to improper initialization of a variable. | ||
| CVE-2025-27071 | Hig | 0.47 | 7.3 | 0.00 | Aug 6, 2025 | Memory corruption while processing specific files in Powerline Communication Firmware. | ||
| CVE-2024-21469 | Hig | 0.47 | 7.3 | 0.00 | Jul 1, 2024 | Memory corruption when an invoke call and a TEE call are bound for the same trusted application. | ||
| CVE-2024-21480 | Hig | 0.47 | 7.3 | 0.00 | May 6, 2024 | Memory corruption while playing audio file having large-sized input buffer. | ||
| CVE-2024-21463 | Hig | 0.47 | 7.3 | 0.00 | Apr 1, 2024 | Memory corruption while processing Codec2 during v13k decoder pitch synthesis. | ||
| CVE-2026-24090 | Hig | 0.46 | 7.1 | 0.00 | Jun 1, 2026 | Cryptographic issue while processing partition table entries allows unauthorized modification of boot flow. | ||
| CVE-2025-47378 | Hig | 0.46 | 7.1 | 0.00 | Mar 2, 2026 | Cryptographic Issue when a shared VM reference allows HLOS to boot loader and access cert chain. | ||
| CVE-2025-47366 | Hig | 0.46 | 7.1 | 0.00 | Feb 2, 2026 | Cryptographic issue when a Trusted Zone with outdated code is triggered by a HLOS providing incorrect input. |
- risk 0.49cvss 7.5epss 0.00
Transient DOS while parsing the received TID-to-link mapping action frame.
- risk 0.49cvss 7.5epss 0.00
Transient DOS while parsing the received TID-to-link mapping element of the TID-to-link mapping action frame.
- risk 0.49cvss 7.5epss 0.00
Transient DOS while parsing SCAN RNR IE when bytes received from AP is such that the size of the last param of IE is less than neighbor report.
- risk 0.49cvss 7.5epss 0.00
Transient DOS while parsing ESP IE from beacon/probe response frame.
- risk 0.49cvss 7.5epss 0.00
Transient DOS when driver accesses the ML IE memory and offset value is incremented beyond ML IE length.
- risk 0.49cvss 7.5epss 0.00
Transient DOS while parsing the multiple MBSSID IEs from the beacon, when the tag length is non-zero value but with end of beacon.
- risk 0.49cvss 7.5epss 0.00
Transient DOS while parsing the MBSSID IE from the beacons, when the MBSSID IE length is zero.
- risk 0.49cvss 7.5epss 0.00
Transient DOS while parsing fragments of MBSSID IE from beacon frame.
- risk 0.49cvss 7.5epss 0.00
Transient DOS while parsing a protected 802.11az Fine Time Measurement (FTM) frame.
- risk 0.47cvss 7.2epss 0.00
Memory Corruption when processing fastboot commands to set display mode.
- risk 0.47cvss 7.2epss 0.00
Memory corruption while processing fastboot commands with improperly formatted input.
- risk 0.47cvss 7.2epss 0.00
Memory corruption while processing fastboot commands with invalid input.
- risk 0.47cvss 7.2epss 0.00
Memory Corruption when processing display command line information due to improper initialization of a variable.
- risk 0.47cvss 7.3epss 0.00
Memory corruption while processing specific files in Powerline Communication Firmware.
- risk 0.47cvss 7.3epss 0.00
Memory corruption when an invoke call and a TEE call are bound for the same trusted application.
- risk 0.47cvss 7.3epss 0.00
Memory corruption while playing audio file having large-sized input buffer.
- risk 0.47cvss 7.3epss 0.00
Memory corruption while processing Codec2 during v13k decoder pitch synthesis.
- risk 0.46cvss 7.1epss 0.00
Cryptographic issue while processing partition table entries allows unauthorized modification of boot flow.
- risk 0.46cvss 7.1epss 0.00
Cryptographic Issue when a shared VM reference allows HLOS to boot loader and access cert chain.
- risk 0.46cvss 7.1epss 0.00
Cryptographic issue when a Trusted Zone with outdated code is triggered by a HLOS providing incorrect input.
Page 7 of 10