Version QCA6554A

CVE-2024-45558

Transient DOS can occur when the driver parses the per STA profile IE and tries to access the EXTN element ID without checking the IE length.

HIGH CVSS 7.5 Published Jan 06, 2025

CVE-2024-33063

Transient DOS while parsing the ML IE when a beacon with common info length of the ML IE greater than the ML IE inside which this element is present.

HIGH CVSS 7.5 Published Dec 02, 2024

CVE-2024-33056

Memory corruption when allocating and accessing an entry in an SMEM partition continuously.

HIGH CVSS 8.4 Published Dec 02, 2024

CVE-2024-38408

Cryptographic issue when a controller receives an LMP start encryption command under unexpected conditions.

HIGH CVSS 8.2 Published Nov 04, 2024

CVE-2024-38405

Transient DOS while processing the CU information from RNR IE.

HIGH CVSS 7.5 Published Nov 04, 2024

CVE-2024-38403

Transient DOS while parsing BTM ML IE when per STA profile is not included.

HIGH CVSS 7.5 Published Nov 04, 2024

CVE-2024-33068

Transient DOS while parsing fragments of MBSSID IE from beacon frame.

HIGH CVSS 7.5 Published Nov 04, 2024

CVE-2024-38397

Transient DOS while parsing probe response and assoc response frame.

HIGH CVSS 7.5 Published Oct 07, 2024

CVE-2024-33073

Information disclosure while parsing the BSS parameter change count or MLD capabilities fields of the ML IE.

HIGH CVSS 8.2 Published Oct 07, 2024

CVE-2024-33069

Transient DOS when transmission of management frame sent by host is not successful and error status is received in the host.

HIGH CVSS 7.5 Published Oct 07, 2024

CVE-2024-33049

Transient DOS while parsing noninheritance IE of Extension element when length of IE is 2 of beacon frame.

HIGH CVSS 7.5 Published Oct 07, 2024

CVE-2024-33057

Transient DOS while parsing the multi-link element Control field when common information length check is missing before updating the location.

HIGH CVSS 7.5 Published Sep 02, 2024

CVE-2024-33051

Transient DOS while processing TIM IE from beacon frame as there is no check for IE length.

HIGH CVSS 7.5 Published Sep 02, 2024

CVE-2024-33050

Transient DOS while parsing MBSSID during new IE generation in beacon/probe frame when IE length check is either missing or improper.

HIGH CVSS 7.5 Published Sep 02, 2024

CVE-2024-33048

Transient DOS while parsing the received TID-to-link mapping element of beacon/probe response frame.

HIGH CVSS 7.5 Published Sep 02, 2024

CVE-2024-23364

Transient DOS when processing the non-transmitted BSSID profile sub-elements present within the MBSSID Information Element (IE) of a beacon frame that is received from over-the-air (OTA).

HIGH CVSS 7.5 Published Sep 02, 2024

CVE-2024-33026

Transient DOS while parsing probe response and assoc response frame when received frame length is less than max size of timestamp.

HIGH CVSS 7.5 Published Aug 05, 2024

CVE-2024-33025

Transient DOS while parsing the BSS parameter change count or MLD capabilities fields of the ML IE.

HIGH CVSS 7.5 Published Aug 05, 2024

CVE-2024-33024

Transient DOS while parsing the ML IE when a beacon with length field inside the common info of ML IE greater than the ML IE length.

HIGH CVSS 7.5 Published Aug 05, 2024

CVE-2024-33020

Transient DOS while processing TID-to-link mapping IE elements.

HIGH CVSS 7.5 Published Aug 05, 2024

CVE-2024-33019

Transient DOS while parsing the received TID-to-link mapping action frame.

HIGH CVSS 7.5 Published Aug 05, 2024

CVE-2024-33018

Transient DOS while parsing the received TID-to-link mapping element of the TID-to-link mapping action frame.

HIGH CVSS 7.5 Published Aug 05, 2024

CVE-2024-33015

Transient DOS while parsing SCAN RNR IE when bytes received from AP is such that the size of the last param of IE is less than neighbor report.

HIGH CVSS 7.5 Published Aug 05, 2024

CVE-2024-33014

Transient DOS while parsing ESP IE from beacon/probe response frame.

HIGH CVSS 7.5 Published Aug 05, 2024

CVE-2024-33013

Transient DOS when driver accesses the ML IE memory and offset value is incremented beyond ML IE length.

HIGH CVSS 7.5 Published Aug 05, 2024

CVE-2024-33012

Transient DOS while parsing the multiple MBSSID IEs from the beacon, when the tag length is non-zero value but with end of beacon.

HIGH CVSS 7.5 Published Aug 05, 2024

CVE-2024-33011

Transient DOS while parsing the MBSSID IE from the beacons, when the MBSSID IE length is zero.

HIGH CVSS 7.5 Published Aug 05, 2024

CVE-2024-33010

Transient DOS while parsing fragments of MBSSID IE from beacon frame.

HIGH CVSS 7.5 Published Aug 05, 2024

CVE-2024-21467

Information disclosure while handling beacon probe frame during scan entry generation in client side.

MEDIUM CVSS 6.5 Published Aug 05, 2024

CVE-2024-21459

Information disclosure while handling beacon or probe response frame in STA.

MEDIUM CVSS 6.5 Published Aug 05, 2024

CVE-2024-21466

Information disclosure while parsing sub-IE length during new IE generation.

MEDIUM CVSS 6.5 Published Jul 01, 2024

CVE-2024-21458

Information disclosure while handling SA query action frame.

MEDIUM CVSS 6.5 Published Jul 01, 2024

CVE-2024-21457

INformation disclosure while handling Multi-link IE in beacon frame.

MEDIUM CVSS 6.5 Published Jul 01, 2024

CVE-2024-21456

Information Disclosure while parsing beacon frame in STA.

MEDIUM CVSS 6.5 Published Jul 01, 2024

CVE-2024-23363

Transient DOS while processing an improperly formatted Fine Time Measurement (FTM) management frame.

HIGH CVSS 7.5 Published Jun 03, 2024

CVE-2023-43545

Memory corruption when more scan frequency list or channels are sent from the user space.

MEDIUM CVSS 6.7 Published Jun 03, 2024

CVE-2023-43537

Information disclosure while handling T2LM Action Frame in WLAN Host.

MEDIUM CVSS 6.5 Published Jun 03, 2024

CVE-2024-21477

Transient DOS while parsing a protected 802.11az Fine Time Measurement (FTM) frame.

HIGH CVSS 7.5 Published May 06, 2024

CVE-2023-43553

Memory corruption while parsing beacon/probe response frame when AP sends more supported links in MLIE.

CRITICAL CVSS 9.8 Published Mar 04, 2024

CVE-2023-43552

Memory corruption while processing MBSSID beacon containing several subelement IE.

CRITICAL CVSS 9.8 Published Mar 04, 2024

CVE-2023-43549

Memory corruption while processing TPC target power table in FTM TPC.

HIGH CVSS 8.4 Published Mar 04, 2024

CVE-2023-43539

Transient DOS while processing an improperly formatted 802.11az Fine Time Measurement protocol frame.

HIGH CVSS 7.5 Published Mar 04, 2024

CVE-2023-43536

Transient DOS while parse fils IE with length equal to 1.

HIGH CVSS 7.5 Published Feb 06, 2024

CVE-2023-43534

Memory corruption while validating the TID to Link Mapping action request frame, when a station connects to an access point.

HIGH CVSS 8.6 Published Feb 06, 2024

CVE-2023-43533

Transient DOS in WLAN Firmware when the length of received beacon is less than length of ieee802.11 beacon frame.

HIGH CVSS 7.5 Published Feb 06, 2024

CVE-2023-43523

Transient DOS while processing 11AZ RTT management action frame received through OTA.

HIGH CVSS 7.5 Published Feb 06, 2024

CVE-2023-43522

Transient DOS while key unwrapping process, when the given encrypted key is empty or NULL.

HIGH CVSS 7.5 Published Feb 06, 2024

CVE-2023-43520

Memory corruption when AP includes TID to link mapping IE in the beacons and STA is parsing the beacon TID to link mapping IE.

HIGH CVSS 8.6 Published Feb 06, 2024

CVE-2023-43511

Transient DOS while parsing IPv6 extension header when WLAN firmware receives an IPv6 packet that contains `IPPROTO_NONE` as the next header.

HIGH CVSS 7.5 Published Jan 02, 2024

CVE-2023-33113

Memory corruption when resource manager sends the host kernel a reply message with multiple fragments.

HIGH CVSS 8.4 Published Jan 02, 2024

CVE-2023-33112

Transient DOS when WLAN firmware receives "reassoc response" frame including RIC_DATA element.

HIGH CVSS 7.5 Published Jan 02, 2024

CVE-2023-33109

Transient DOS while processing a WMI P2P listen start command (0xD00A) sent from host.

HIGH CVSS 7.5 Published Jan 02, 2024

CVE-2023-33062

Transient DOS in WLAN Firmware while parsing a BTM request.

HIGH CVSS 7.5 Published Jan 02, 2024

CVE-2023-33098

Transient DOS while parsing WPA IES, when it is passed with length more than expected size.

HIGH CVSS 7.5 Published Dec 05, 2023

CVE-2023-33097

Transient DOS in WLAN Firmware while processing a FTMR frame.

HIGH CVSS 7.5 Published Dec 05, 2023

CVE-2023-33089

Transient DOS when processing a NULL buffer while parsing WLAN vdev.

HIGH CVSS 7.5 Published Dec 05, 2023

CVE-2023-33088

Memory corruption when processing cmd parameters while parsing vdev.

HIGH CVSS 8.4 Published Dec 05, 2023

CVE-2023-33081

Transient DOS while converting TWT (Target Wake Time) frame parameters in the OTA broadcast.

HIGH CVSS 7.5 Published Dec 05, 2023

CVE-2023-33080

Transient DOS while parsing a vender specific IE (Information Element) of reassociation response management frame.

HIGH CVSS 7.5 Published Dec 05, 2023

CVE-2023-33041

Under certain scenarios the WLAN Firmware will reach an assertion due to state confusion while looking up peer ids.

HIGH CVSS 7.5 Published Dec 05, 2023

CVE-2023-28587

Memory corruption in BT controller while parsing debug commands with specific sub-opcodes at HCI interface level.

HIGH CVSS 7.8 Published Dec 05, 2023

CVE-2023-28550

Memory corruption in MPP performance while accessing DSM watermark using external memory address.

HIGH CVSS 7.8 Published Dec 05, 2023

CVE-2023-33061

Transient DOS in WLAN Firmware while parsing WLAN beacon or probe-response frame.

HIGH CVSS 7.5 Published Nov 07, 2023

CVE-2023-33056

Transient DOS in WLAN Firmware when firmware receives beacon including T2LM IE.

HIGH CVSS 7.5 Published Nov 07, 2023

CVE-2023-33048

Transient DOS in WLAN Firmware while parsing t2lm buffers.

HIGH CVSS 7.5 Published Nov 07, 2023

CVE-2023-33047

Transient DOS in WLAN Firmware while parsing no-inherit IES.

HIGH CVSS 7.5 Published Nov 07, 2023

CVE-2023-33045

Memory corruption in WLAN Firmware while parsing a NAN management frame carrying a S3 attribute.

CRITICAL CVSS 9.8 Published Nov 07, 2023

CVE-2023-28572

Memory corruption in WLAN HOST while processing the WLAN scan descriptor list.

MEDIUM CVSS 6.6 Published Nov 07, 2023

CVE-2023-28570

Memory corruption while processing audio effects.

MEDIUM CVSS 6.7 Published Nov 07, 2023

CVE-2023-28569

Information disclosure in WLAN HAL while handling command through WMI interfaces.

MEDIUM CVSS 6.1 Published Nov 07, 2023

CVE-2023-28566

Information disclosure in WLAN HAL while handling the WMI state info command.

MEDIUM CVSS 6.1 Published Nov 07, 2023

CVE-2023-28563

Information disclosure in IOE Firmware while handling WMI command.

MEDIUM CVSS 6.1 Published Nov 07, 2023

CVE-2023-28554

Information Disclosure in Qualcomm IPC while reading values from shared memory in VM.

MEDIUM CVSS 6.1 Published Nov 07, 2023

CVE-2023-28553

Information Disclosure in WLAN Host when processing WMI event command.

MEDIUM CVSS 6.1 Published Nov 07, 2023

CVE-2023-33028

Memory corruption in WLAN Firmware while doing a memory copy of pmk cache.

CRITICAL CVSS 9.8 Published Oct 03, 2023

CVE-2023-33027

Transient DOS in WLAN Firmware while parsing rsn ies.

HIGH CVSS 7.5 Published Oct 03, 2023

CVE-2023-33026

Transient DOS in WLAN Firmware while parsing a NAN management frame.

HIGH CVSS 7.5 Published Oct 03, 2023

CVE-2023-28571

Information disclosure in WLAN HOST while processing the WLAN scan descriptor list during roaming scan.

MEDIUM CVSS 6.1 Published Oct 03, 2023

CVE-2023-28539

Memory corruption in WLAN Host when the firmware invokes multiple WMI Service Available command.

MEDIUM CVSS 6.6 Published Oct 03, 2023

CVE-2023-33020

Transient DOS in WLAN Host when an invalid channel (like channel out of range) is received in STA during CSA IE.

HIGH CVSS 7.5 Published Sep 05, 2023

CVE-2023-33019

Transient DOS in WLAN Host while doing channel switch announcement (CSA), when a mobile station receives invalid channel in CSA IE.

HIGH CVSS 7.5 Published Sep 05, 2023

CVE-2023-33015

Transient DOS in WLAN Firmware while interpreting MBSSID IE of a received beacon frame.

HIGH CVSS 7.5 Published Sep 05, 2023

CVE-2023-28584

Transient DOS in WLAN Host when a mobile station receives invalid channel in CSA IE while doing channel switch announcement (CSA).

HIGH CVSS 7.5 Published Sep 05, 2023

CVE-2023-28573

Memory corruption in WLAN HAL while parsing WMI command parameters.

HIGH CVSS 7.8 Published Sep 05, 2023

CVE-2023-28567

Memory corruption in WLAN HAL while handling command through WMI interfaces.

HIGH CVSS 7.8 Published Sep 05, 2023

CVE-2023-28565

Memory corruption in WLAN HAL while handling command streams through WMI interfaces.

HIGH CVSS 7.8 Published Sep 05, 2023

CVE-2023-28564

Memory corruption in WLAN HAL while passing command parameters through WMI interfaces.

HIGH CVSS 7.8 Published Sep 05, 2023

CVE-2023-28560

Memory corruption in WLAN HAL while processing devIndex from untrusted WMI payload.

HIGH CVSS 7.8 Published Sep 05, 2023

CVE-2023-28559

Memory corruption in WLAN FW while processing command parameters from untrusted WMI payload.

HIGH CVSS 7.8 Published Sep 05, 2023

CVE-2023-28558

Memory corruption in WLAN handler while processing PhyID in Tx status handler.

HIGH CVSS 7.8 Published Sep 05, 2023

CVE-2023-28557

Memory corruption in WLAN HAL while processing command parameters from untrusted WMI payload.

HIGH CVSS 7.8 Published Sep 05, 2023

CVE-2023-28549

Memory corruption in WLAN HAL while parsing Rx buffer in processing TLV payload.

HIGH CVSS 7.8 Published Sep 05, 2023

CVE-2023-28548

Memory corruption in WLAN HAL while processing Tx/Rx commands from QDART.

HIGH CVSS 7.8 Published Sep 05, 2023

CVE-2023-28544

Memory corruption in WLAN while sending transmit command from HLOS to UTF handlers.

HIGH CVSS 7.8 Published Sep 05, 2023

CVE-2022-33275

Memory corruption due to improper validation of array index in WLAN HAL when received lm_itemNum is out of range.

HIGH CVSS 8.4 Published Sep 05, 2023

CVE-2023-21649

Memory corruption in WLAN while running doDriverCmd for an unspecific command.

MEDIUM CVSS 6.7 Published Aug 08, 2023

CVE-2023-28542

Memory Corruption in WLAN HOST while fetching TX status information.

HIGH CVSS 7.8 Published Jul 04, 2023

CVE-2023-28541

Memory Corruption in Data Modem while processing DMA buffer release event about CFR data.

HIGH CVSS 7.8 Published Jul 04, 2023

CVE-2023-24854

Memory Corruption in WLAN HOST while parsing QMI WLAN Firmware response message.

HIGH CVSS 7.8 Published Jul 04, 2023

CVE-2023-24851

Memory Corruption in WLAN HOST while parsing QMI response message from firmware.

HIGH CVSS 7.8 Published Jul 04, 2023

CVE-2023-22386

Memory Corruption in WLAN HOST while processing WLAN FW request to allocate memory.

HIGH CVSS 7.8 Published Jul 04, 2023

CVE-2023-21659

Transient DOS in WLAN Firmware while processing frames with missing header fields.

HIGH CVSS 7.5 Published Jun 06, 2023

CVE-2023-21658

Transient DOS in WLAN Firmware while processing the received beacon or probe response frame.

HIGH CVSS 7.5 Published Jun 06, 2023

CVE-2023-21656

Memory corruption in WLAN HOST while receiving an WMI event from firmware.

HIGH CVSS 7.8 Published Jun 06, 2023

CVE-2023-21628

Memory corruption in WLAN HAL while processing WMI-UTF command or FTM TLV1 command.

HIGH CVSS 8.4 Published Jun 06, 2023

CVE-2022-33230

Memory corruption in FM Host due to buffer copy without checking the size of input in FM Host

MEDIUM CVSS 6.7 Published Jun 06, 2023

CVE-2022-40532

Memory corruption due to integer overflow or wraparound in WLAN while sending WMI cmd from host to target.

HIGH CVSS 8.4 Published Apr 04, 2023

CVE-2022-40503

Information disclosure due to buffer over-read in Bluetooth Host while A2DP streaming.

HIGH CVSS 8.2 Published Apr 04, 2023

CVE-2022-40531

Memory corruption in WLAN due to incorrect type cast while sending WMI_SCAN_SCH_PRIO_TBL_CMDID message.

HIGH CVSS 8.4 Published Mar 07, 2023

CVE-2022-40530

Memory corruption in WLAN due to integer overflow to buffer overflow in WLAN during initialization phase.

HIGH CVSS 8.4 Published Mar 07, 2023

CVE-2022-25655

Memory corruption in WLAN HAL while arbitrary value is passed in WMI UTF command payload.

HIGH CVSS 8.4 Published Mar 07, 2023

CVE-2022-40514

Memory corruption due to buffer copy without checking the size of input in WLAN Firmware while processing CCKM IE in reassoc response frame.

CRITICAL CVSS 9.8 Published Feb 09, 2023

CVE-2022-40512

Transient DOS in WLAN Firmware due to buffer over-read while processing probe response or beacon.

HIGH CVSS 7.5 Published Feb 09, 2023

CVE-2022-40502

Transient DOS due to improper input validation in WLAN Host.

HIGH CVSS 7.5 Published Feb 09, 2023

CVE-2022-34146

Transient DOS due to improper input validation in WLAN Host while parsing frame during defragmentation.

HIGH CVSS 7.5 Published Feb 09, 2023

CVE-2022-34145

Transient DOS due to buffer over-read in WLAN Host while parsing frame information.

HIGH CVSS 7.5 Published Feb 09, 2023

CVE-2022-33306

Transient DOS due to buffer over-read in WLAN while processing an incoming management frame with incorrectly filled IEs.

HIGH CVSS 7.5 Published Feb 09, 2023

CVE-2022-33277

Memory corruption in modem due to buffer copy without checking size of input while receiving WMI command.

HIGH CVSS 8.4 Published Feb 09, 2023

CVE-2022-33271

Information disclosure due to buffer over-read in WLAN while parsing NMF frame.

HIGH CVSS 8.2 Published Feb 09, 2023

CVE-2022-33286

Transient DOS due to buffer over-read in WLAN while processing 802.11 management frames.

HIGH CVSS 7.5 Published Jan 06, 2023

CVE-2022-33285

Transient DOS due to buffer over-read in WLAN while parsing WLAN CSA action frames.

HIGH CVSS 7.5 Published Jan 06, 2023

CVE-2022-33284

Information disclosure due to buffer over-read in WLAN while parsing BTM action frame.

HIGH CVSS 8.2 Published Jan 06, 2023

CVE-2022-33283

Information disclosure due to buffer over-read in WLAN while WLAN frame parsing due to missing frame length check.

HIGH CVSS 8.2 Published Jan 06, 2023

CVE-2022-33276

Memory corruption due to buffer copy without checking size of input in modem while receiving WMI_REQUEST_STATS_CMDID command.

HIGH CVSS 8.4 Published Jan 06, 2023

CVE-2022-33253

Transient DOS due to buffer over-read in WLAN while parsing corrupted NAN frames.

HIGH CVSS 7.5 Published Jan 06, 2023

CVE-2022-33252

Information disclosure due to buffer over-read in WLAN while handling IBSS beacons frame.

HIGH CVSS 8.2 Published Jan 06, 2023