Qca6678aq Firmware
by Qualcomm
CVEs (253)
| CVE | Vendor / Product | Sev | Risk | CVSS | EPSS | KEV | Published | Description |
|---|---|---|---|---|---|---|---|---|
| CVE-2022-33275 | Hig | 0.55 | 8.4 | 0.00 | Sep 5, 2023 | Memory corruption due to improper validation of array index in WLAN HAL when received lm_itemNum is out of range. | ||
| CVE-2022-40532 | Hig | 0.55 | 8.4 | 0.00 | Apr 13, 2023 | Memory corruption due to integer overflow or wraparound in WLAN while sending WMI cmd from host to target. | ||
| CVE-2022-40531 | Hig | 0.55 | 8.4 | 0.00 | Mar 10, 2023 | Memory corruption in WLAN due to incorrect type cast while sending WMI_SCAN_SCH_PRIO_TBL_CMDID message. | ||
| CVE-2022-40530 | Hig | 0.55 | 8.4 | 0.00 | Mar 10, 2023 | Memory corruption in WLAN due to integer overflow to buffer overflow in WLAN during initialization phase. | ||
| CVE-2022-33277 | Hig | 0.55 | 8.4 | 0.00 | Feb 12, 2023 | Memory corruption in modem due to buffer copy without checking size of input while receiving WMI command. | ||
| CVE-2026-24079 | Hig | 0.53 | 8.1 | 0.00 | Aug 4, 2026 | Cryptographic Issue while processing registration requests with malformed or missing authentication parameters. | ||
| CVE-2025-21487 | Hig | 0.53 | 8.2 | 0.00 | Sep 24, 2025 | Information disclosure while decoding RTP packet received by UE from the network, when payload length mentioned is greater than the available buffer length. | ||
| CVE-2025-21484 | Hig | 0.53 | 8.2 | 0.00 | Sep 24, 2025 | Information disclosure when UE receives the RTP packet from the network, while decoding and reassembling the fragments from RTP packet. | ||
| CVE-2025-21427 | Hig | 0.53 | 8.2 | 0.00 | Jul 8, 2025 | Information disclosure while decoding this RTP packet Payload when UE receives the RTP packet from the network. | ||
| CVE-2024-53026 | Hig | 0.53 | 8.2 | 0.00 | Jun 3, 2025 | Information disclosure when an invalid RTCP packet is received during a VoLTE/VoWiFi IMS call. | ||
| CVE-2024-53021 | Hig | 0.53 | 8.2 | 0.00 | Jun 3, 2025 | Information disclosure may occur while processing goodbye RTCP packet from network. | ||
| CVE-2024-53020 | Hig | 0.53 | 8.2 | 0.00 | Jun 3, 2025 | Information disclosure may occur while decoding the RTP packet with invalid header extension from network. | ||
| CVE-2024-49846 | Hig | 0.53 | 8.2 | 0.00 | May 6, 2025 | Memory corruption while decoding of OTA messages from T3448 IE. | ||
| CVE-2024-49839 | Hig | 0.53 | 8.2 | 0.00 | Feb 3, 2025 | Memory corruption during management frame processing due to mismatch in T2LM info element. | ||
| CVE-2024-49838 | Hig | 0.53 | 8.2 | 0.00 | Feb 3, 2025 | Information disclosure while parsing the OCI IE with invalid length. | ||
| CVE-2024-38408 | Hig | 0.53 | 8.2 | 0.00 | Nov 4, 2024 | Cryptographic issue when a controller receives an LMP start encryption command under unexpected conditions. | ||
| CVE-2024-33073 | Hig | 0.53 | 8.2 | 0.00 | Oct 7, 2024 | Information disclosure while parsing the BSS parameter change count or MLD capabilities fields of the ML IE. | ||
| CVE-2022-33271 | Hig | 0.53 | 8.2 | 0.00 | Feb 12, 2023 | Information disclosure due to buffer over-read in WLAN while parsing NMF frame. | ||
| CVE-2025-47357 | Hig | 0.52 | 8.0 | 0.00 | Nov 4, 2025 | Information Disclosure when a user-level driver performs QFPROM read or write operations on Fuse regions. | ||
| CVE-2026-24080 | Hig | 0.51 | 7.8 | 0.00 | Aug 4, 2026 | Memory Corruption when handling malformed request parameters in the fingerprint TA. |
- risk 0.55cvss 8.4epss 0.00
Memory corruption due to improper validation of array index in WLAN HAL when received lm_itemNum is out of range.
- risk 0.55cvss 8.4epss 0.00
Memory corruption due to integer overflow or wraparound in WLAN while sending WMI cmd from host to target.
- risk 0.55cvss 8.4epss 0.00
Memory corruption in WLAN due to incorrect type cast while sending WMI_SCAN_SCH_PRIO_TBL_CMDID message.
- risk 0.55cvss 8.4epss 0.00
Memory corruption in WLAN due to integer overflow to buffer overflow in WLAN during initialization phase.
- risk 0.55cvss 8.4epss 0.00
Memory corruption in modem due to buffer copy without checking size of input while receiving WMI command.
- risk 0.53cvss 8.1epss 0.00
Cryptographic Issue while processing registration requests with malformed or missing authentication parameters.
- risk 0.53cvss 8.2epss 0.00
Information disclosure while decoding RTP packet received by UE from the network, when payload length mentioned is greater than the available buffer length.
- risk 0.53cvss 8.2epss 0.00
Information disclosure when UE receives the RTP packet from the network, while decoding and reassembling the fragments from RTP packet.
- risk 0.53cvss 8.2epss 0.00
Information disclosure while decoding this RTP packet Payload when UE receives the RTP packet from the network.
- risk 0.53cvss 8.2epss 0.00
Information disclosure when an invalid RTCP packet is received during a VoLTE/VoWiFi IMS call.
- risk 0.53cvss 8.2epss 0.00
Information disclosure may occur while processing goodbye RTCP packet from network.
- risk 0.53cvss 8.2epss 0.00
Information disclosure may occur while decoding the RTP packet with invalid header extension from network.
- risk 0.53cvss 8.2epss 0.00
Memory corruption while decoding of OTA messages from T3448 IE.
- risk 0.53cvss 8.2epss 0.00
Memory corruption during management frame processing due to mismatch in T2LM info element.
- risk 0.53cvss 8.2epss 0.00
Information disclosure while parsing the OCI IE with invalid length.
- risk 0.53cvss 8.2epss 0.00
Cryptographic issue when a controller receives an LMP start encryption command under unexpected conditions.
- risk 0.53cvss 8.2epss 0.00
Information disclosure while parsing the BSS parameter change count or MLD capabilities fields of the ML IE.
- risk 0.53cvss 8.2epss 0.00
Information disclosure due to buffer over-read in WLAN while parsing NMF frame.
- risk 0.52cvss 8.0epss 0.00
Information Disclosure when a user-level driver performs QFPROM read or write operations on Fuse regions.
- risk 0.51cvss 7.8epss 0.00
Memory Corruption when handling malformed request parameters in the fingerprint TA.
Page 3 of 13