Wcn6450 Firmware
by Qualcomm
CVEs (742)
| CVE | Vendor / Product | Sev | Risk | CVSS | EPSS | KEV | Published | Description |
|---|---|---|---|---|---|---|---|---|
| CVE-2020-11281 | Hig | 0.49 | 7.5 | 0.01 | Feb 22, 2021 | Allowing RTT frames to be linked with non randomized MAC address by comparing the sequence numbers can lead to information disclosure. in Snapdragon Auto, Snapdragon Compute, Snapdragon Connectivity, Snapdragon Consumer Electronics Connectivity, Snapdragon Consumer IOT,… | ||
| CVE-2020-11280 | Hig | 0.49 | 7.5 | 0.01 | Feb 22, 2021 | Denial of service while processing fine timing measurement request (FTMR) frame with reserved bits set in the FTM parameter IE due to improper error handling in Snapdragon Auto, Snapdragon Compute, Snapdragon Connectivity, Snapdragon Consumer Electronics Connectivity, Snapdragon… | ||
| CVE-2020-11278 | Hig | 0.49 | 7.5 | 0.01 | Feb 22, 2021 | Possible denial of service while handling host WMI command due to improper validation in Snapdragon Auto, Snapdragon Compute, Snapdragon Connectivity, Snapdragon Consumer Electronics Connectivity, Snapdragon Consumer IOT, Snapdragon Industrial IOT, Snapdragon Mobile, Snapdragon… | ||
| CVE-2020-11270 | Hig | 0.49 | 7.5 | 0.01 | Feb 22, 2021 | Possible denial of service due to RTT responder consistently rejects all FTMR by transmitting FTM1 with failure status in the FTM parameter IE in Snapdragon Auto, Snapdragon Compute, Snapdragon Connectivity, Snapdragon Consumer Electronics Connectivity, Snapdragon Consumer IOT,… | ||
| CVE-2020-11119 | Hig | 0.49 | 7.5 | 0.01 | Jan 21, 2021 | Buffer over-read can happen when the buffer length received from response handlers is more than the size of the payload in Snapdragon Auto, Snapdragon Compute, Snapdragon Connectivity, Snapdragon Consumer Electronics Connectivity, Snapdragon Consumer IOT, Snapdragon Industrial… | ||
| CVE-2026-25288 | Hig | 0.48 | 7.4 | 0.00 | Aug 4, 2026 | Transient DOS when processing a short target wake time channel usage response frame with insufficient packet size. | ||
| CVE-2026-24092 | Hig | 0.47 | 7.2 | 0.00 | Jun 1, 2026 | Memory Corruption when processing fastboot commands to set display mode. | ||
| CVE-2026-24091 | Hig | 0.47 | 7.2 | 0.00 | Jun 1, 2026 | Memory corruption while processing fastboot commands with improperly formatted input. | ||
| CVE-2026-24089 | Hig | 0.47 | 7.2 | 0.00 | Jun 1, 2026 | Memory corruption while processing fastboot commands with invalid input. | ||
| CVE-2026-24087 | Hig | 0.47 | 7.2 | 0.00 | Jun 1, 2026 | Memory corruption while processing fastboot OEM commands. | ||
| CVE-2026-24085 | Hig | 0.47 | 7.2 | 0.00 | Jun 1, 2026 | Memory Corruption when processing display command line information due to improper initialization of a variable. | ||
| CVE-2025-47383 | Hig | 0.47 | 7.2 | 0.00 | Mar 2, 2026 | Weak configuration may lead to cryptographic issue when a VoWiFi call is triggered from UE. | ||
| CVE-2024-21469 | Hig | 0.47 | 7.3 | 0.00 | Jul 1, 2024 | Memory corruption when an invoke call and a TEE call are bound for the same trusted application. | ||
| CVE-2023-43548 | Hig | 0.47 | 7.3 | 0.00 | Mar 4, 2024 | Memory corruption while parsing qcp clip with invalid chunk data size. | ||
| CVE-2023-43519 | Hig | 0.47 | 7.3 | 0.00 | Feb 6, 2024 | Memory corruption in video while parsing the Videoinfo, when the size of atom is greater than the videoinfo size. | ||
| CVE-2023-43518 | Hig | 0.47 | 7.3 | 0.00 | Feb 6, 2024 | Memory corruption in video while parsing invalid mp2 clip. | ||
| CVE-2022-33273 | Hig | 0.47 | 7.3 | 0.00 | May 2, 2023 | Information disclosure due to buffer over-read in Trusted Execution Environment while QRKS report generation. | ||
| CVE-2022-40537 | Hig | 0.47 | 7.3 | 0.00 | Mar 10, 2023 | Memory corruption in Bluetooth HOST while processing the AVRC_PDU_GET_PLAYER_APP_VALUE_TEXT AVRCP response. | ||
| CVE-2022-40515 | Hig | 0.47 | 7.3 | 0.00 | Mar 10, 2023 | Memory corruption in Video due to double free while playing 3gp clip with invalid metadata atoms. | ||
| CVE-2022-33280 | Hig | 0.47 | 7.3 | 0.00 | Feb 12, 2023 | Memory corruption due to access of uninitialized pointer in Bluetooth HOST while processing the AVRCP packet. |
- risk 0.49cvss 7.5epss 0.01
Allowing RTT frames to be linked with non randomized MAC address by comparing the sequence numbers can lead to information disclosure. in Snapdragon Auto, Snapdragon Compute, Snapdragon Connectivity, Snapdragon Consumer Electronics Connectivity, Snapdragon Consumer IOT,…
- risk 0.49cvss 7.5epss 0.01
Denial of service while processing fine timing measurement request (FTMR) frame with reserved bits set in the FTM parameter IE due to improper error handling in Snapdragon Auto, Snapdragon Compute, Snapdragon Connectivity, Snapdragon Consumer Electronics Connectivity, Snapdragon…
- risk 0.49cvss 7.5epss 0.01
Possible denial of service while handling host WMI command due to improper validation in Snapdragon Auto, Snapdragon Compute, Snapdragon Connectivity, Snapdragon Consumer Electronics Connectivity, Snapdragon Consumer IOT, Snapdragon Industrial IOT, Snapdragon Mobile, Snapdragon…
- risk 0.49cvss 7.5epss 0.01
Possible denial of service due to RTT responder consistently rejects all FTMR by transmitting FTM1 with failure status in the FTM parameter IE in Snapdragon Auto, Snapdragon Compute, Snapdragon Connectivity, Snapdragon Consumer Electronics Connectivity, Snapdragon Consumer IOT,…
- risk 0.49cvss 7.5epss 0.01
Buffer over-read can happen when the buffer length received from response handlers is more than the size of the payload in Snapdragon Auto, Snapdragon Compute, Snapdragon Connectivity, Snapdragon Consumer Electronics Connectivity, Snapdragon Consumer IOT, Snapdragon Industrial…
- risk 0.48cvss 7.4epss 0.00
Transient DOS when processing a short target wake time channel usage response frame with insufficient packet size.
- risk 0.47cvss 7.2epss 0.00
Memory Corruption when processing fastboot commands to set display mode.
- risk 0.47cvss 7.2epss 0.00
Memory corruption while processing fastboot commands with improperly formatted input.
- risk 0.47cvss 7.2epss 0.00
Memory corruption while processing fastboot commands with invalid input.
- risk 0.47cvss 7.2epss 0.00
Memory corruption while processing fastboot OEM commands.
- risk 0.47cvss 7.2epss 0.00
Memory Corruption when processing display command line information due to improper initialization of a variable.
- risk 0.47cvss 7.2epss 0.00
Weak configuration may lead to cryptographic issue when a VoWiFi call is triggered from UE.
- risk 0.47cvss 7.3epss 0.00
Memory corruption when an invoke call and a TEE call are bound for the same trusted application.
- risk 0.47cvss 7.3epss 0.00
Memory corruption while parsing qcp clip with invalid chunk data size.
- risk 0.47cvss 7.3epss 0.00
Memory corruption in video while parsing the Videoinfo, when the size of atom is greater than the videoinfo size.
- risk 0.47cvss 7.3epss 0.00
Memory corruption in video while parsing invalid mp2 clip.
- risk 0.47cvss 7.3epss 0.00
Information disclosure due to buffer over-read in Trusted Execution Environment while QRKS report generation.
- risk 0.47cvss 7.3epss 0.00
Memory corruption in Bluetooth HOST while processing the AVRC_PDU_GET_PLAYER_APP_VALUE_TEXT AVRCP response.
- risk 0.47cvss 7.3epss 0.00
Memory corruption in Video due to double free while playing 3gp clip with invalid metadata atoms.
- risk 0.47cvss 7.3epss 0.00
Memory corruption due to access of uninitialized pointer in Bluetooth HOST while processing the AVRCP packet.
Page 28 of 38