Qca8112 Firmware
by Qualcomm
CVEs (89)
| CVE | Vendor / Product | Sev | Risk | CVSS | EPSS | KEV | Published | Description |
|---|---|---|---|---|---|---|---|---|
| CVE-2025-21440 | Hig | 0.51 | 7.8 | 0.00 | Apr 7, 2025 | Memory corruption when IOCTL call is invoked from user-space to write board data to WLAN driver. | ||
| CVE-2024-45542 | Hig | 0.51 | 7.8 | 0.00 | Jan 6, 2025 | Memory corruption when IOCTL call is invoked from user-space to write board data to WLAN driver. | ||
| CVE-2024-45541 | Hig | 0.51 | 7.8 | 0.00 | Jan 6, 2025 | Memory corruption when IOCTL call is invoked from user-space to read board data. | ||
| CVE-2024-43053 | Hig | 0.51 | 7.8 | 0.00 | Dec 2, 2024 | Memory corruption while invoking IOCTL calls from user space to read WLAN target diagnostic information. | ||
| CVE-2024-43050 | Hig | 0.51 | 7.8 | 0.00 | Dec 2, 2024 | Memory corruption while invoking IOCTL calls from user space to issue factory test command inside WLAN driver. | ||
| CVE-2023-28587 | Hig | 0.51 | 7.8 | 0.00 | Dec 5, 2023 | Memory corruption in BT controller while parsing debug commands with specific sub-opcodes at HCI interface level. | ||
| CVE-2023-28550 | Hig | 0.51 | 7.8 | 0.00 | Dec 5, 2023 | Memory corruption in MPP performance while accessing DSM watermark using external memory address. | ||
| CVE-2023-28573 | Hig | 0.51 | 7.8 | 0.00 | Sep 5, 2023 | Memory corruption in WLAN HAL while parsing WMI command parameters. | ||
| CVE-2023-28567 | Hig | 0.51 | 7.8 | 0.00 | Sep 5, 2023 | Memory corruption in WLAN HAL while handling command through WMI interfaces. | ||
| CVE-2023-28558 | Hig | 0.51 | 7.8 | 0.00 | Sep 5, 2023 | Memory corruption in WLAN handler while processing PhyID in Tx status handler. | ||
| CVE-2023-28557 | Hig | 0.51 | 7.8 | 0.00 | Sep 5, 2023 | Memory corruption in WLAN HAL while processing command parameters from untrusted WMI payload. | ||
| CVE-2023-28549 | Hig | 0.51 | 7.8 | 0.00 | Sep 5, 2023 | Memory corruption in WLAN HAL while parsing Rx buffer in processing TLV payload. | ||
| CVE-2023-28548 | Hig | 0.51 | 7.8 | 0.00 | Sep 5, 2023 | Memory corruption in WLAN HAL while processing Tx/Rx commands from QDART. | ||
| CVE-2021-35129 | Hig | 0.51 | 7.8 | 0.00 | Jun 14, 2022 | Memory corruption in BT controller due to improper length check while processing vendor specific commands in Snapdragon Compute, Snapdragon Connectivity, Snapdragon Consumer Electronics Connectivity, Snapdragon Industrial IOT, Snapdragon Mobile, Snapdragon Wired Infrastructure… | ||
| CVE-2021-30303 | Hig | 0.51 | 7.8 | 0.00 | Jan 3, 2022 | Possible buffer overflow due to lack of buffer length check when segmented WMI command is received in Snapdragon Auto, Snapdragon Compute, Snapdragon Connectivity, Snapdragon Consumer Electronics Connectivity, Snapdragon Consumer IOT, Snapdragon Industrial IOT, Snapdragon… | ||
| CVE-2025-47328 | Hig | 0.49 | 7.5 | 0.00 | Sep 24, 2025 | Transient DOS while processing power control requests with invalid antenna or stream values. | ||
| CVE-2025-47326 | Hig | 0.49 | 7.5 | 0.00 | Sep 24, 2025 | Transient DOS while handling command data during power control processing. | ||
| CVE-2025-27066 | Hig | 0.49 | 7.5 | 0.00 | Aug 6, 2025 | Transient DOS while processing an ANQP message. | ||
| CVE-2025-27065 | Hig | 0.49 | 7.5 | 0.00 | Aug 6, 2025 | Transient DOS while processing a frame with malformed shared-key descriptor. | ||
| CVE-2025-27057 | Hig | 0.49 | 7.5 | 0.00 | Jul 8, 2025 | Transient DOS while handling beacon frames with invalid IE header length. |
- risk 0.51cvss 7.8epss 0.00
Memory corruption when IOCTL call is invoked from user-space to write board data to WLAN driver.
- risk 0.51cvss 7.8epss 0.00
Memory corruption when IOCTL call is invoked from user-space to write board data to WLAN driver.
- risk 0.51cvss 7.8epss 0.00
Memory corruption when IOCTL call is invoked from user-space to read board data.
- risk 0.51cvss 7.8epss 0.00
Memory corruption while invoking IOCTL calls from user space to read WLAN target diagnostic information.
- risk 0.51cvss 7.8epss 0.00
Memory corruption while invoking IOCTL calls from user space to issue factory test command inside WLAN driver.
- risk 0.51cvss 7.8epss 0.00
Memory corruption in BT controller while parsing debug commands with specific sub-opcodes at HCI interface level.
- risk 0.51cvss 7.8epss 0.00
Memory corruption in MPP performance while accessing DSM watermark using external memory address.
- risk 0.51cvss 7.8epss 0.00
Memory corruption in WLAN HAL while parsing WMI command parameters.
- risk 0.51cvss 7.8epss 0.00
Memory corruption in WLAN HAL while handling command through WMI interfaces.
- risk 0.51cvss 7.8epss 0.00
Memory corruption in WLAN handler while processing PhyID in Tx status handler.
- risk 0.51cvss 7.8epss 0.00
Memory corruption in WLAN HAL while processing command parameters from untrusted WMI payload.
- risk 0.51cvss 7.8epss 0.00
Memory corruption in WLAN HAL while parsing Rx buffer in processing TLV payload.
- risk 0.51cvss 7.8epss 0.00
Memory corruption in WLAN HAL while processing Tx/Rx commands from QDART.
- risk 0.51cvss 7.8epss 0.00
Memory corruption in BT controller due to improper length check while processing vendor specific commands in Snapdragon Compute, Snapdragon Connectivity, Snapdragon Consumer Electronics Connectivity, Snapdragon Industrial IOT, Snapdragon Mobile, Snapdragon Wired Infrastructure…
- risk 0.51cvss 7.8epss 0.00
Possible buffer overflow due to lack of buffer length check when segmented WMI command is received in Snapdragon Auto, Snapdragon Compute, Snapdragon Connectivity, Snapdragon Consumer Electronics Connectivity, Snapdragon Consumer IOT, Snapdragon Industrial IOT, Snapdragon…
- risk 0.49cvss 7.5epss 0.00
Transient DOS while processing power control requests with invalid antenna or stream values.
- risk 0.49cvss 7.5epss 0.00
Transient DOS while handling command data during power control processing.
- risk 0.49cvss 7.5epss 0.00
Transient DOS while processing an ANQP message.
- risk 0.49cvss 7.5epss 0.00
Transient DOS while processing a frame with malformed shared-key descriptor.
- risk 0.49cvss 7.5epss 0.00
Transient DOS while handling beacon frames with invalid IE header length.
Page 2 of 5