CVE-2019-10481
Last modified
CVE-2019-10481 is a high-severity vulnerability rated 7.8/10 on the CVSS scale. Out of bound access occurs while handling the WMI FW event due to lack of check of buffer argument which comes directly from the WLAN FW in Snapdragon Auto, Snapdragon Consumer Electronics Connectivity, Snapdragon Consumer IOT, Snapdragon Industrial IOT, Snapdragon Mobile, Snapdragon Voice & Music, Snapdragon Wired Infrastructure and Networking in APQ8096AU, IPQ4019, IPQ8064, IPQ8074, MDM9607, MSM8996AU, QCA6574AU, QCA8081, QCN7605, SDX55, SM6150, SM7150, SM8150. EPSS estimates a 0.20% chance of exploitation in the next 30 days.
Description
Out of bound access occurs while handling the WMI FW event due to lack of check of buffer argument which comes directly from the WLAN FW in Snapdragon Auto, Snapdragon Consumer Electronics Connectivity, Snapdragon Consumer IOT, Snapdragon Industrial IOT, Snapdragon Mobile, Snapdragon Voice & Music, Snapdragon Wired Infrastructure and Networking in APQ8096AU, IPQ4019, IPQ8064, IPQ8074, MDM9607, MSM8996AU, QCA6574AU, QCA8081, QCN7605, SDX55, SM6150, SM7150, SM8150
Metrics
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Weakness Enumeration
Affected Software
| Vendor | Product | Versions |
|---|---|---|
| Qualcomm | Apq8096au Firmware | All versions |
| Qualcomm | Ipq4019 Firmware | All versions |
| Qualcomm | Ipq8064 Firmware | All versions |
| Qualcomm | Ipq8074 Firmware | All versions |
| Qualcomm | Mdm9607 Firmware | All versions |
| Qualcomm | Msm8996au Firmware | All versions |
| Qualcomm | Qca6574au Firmware | All versions |
| Qualcomm | Qca8081 Firmware | All versions |
| Qualcomm | Qcn7605 Firmware | All versions |
| Qualcomm | Sdx55 Firmware | All versions |
| Qualcomm | Sm6150 Firmware | All versions |
| Qualcomm | Sm7150 Firmware | All versions |
| Qualcomm | Sm8150 Firmware | All versions |
References
- https://www.qualcomm.com/company/product-security/bulletins/december-2019-bulletinPatch, Vendor Advisory
- https://www.qualcomm.com/company/product-security/bulletins/december-2019-bulletinPatch, Vendor Advisory
Timeline
- Published
- Last Modified
- Status
- Modified
Frequently Asked Questions
What is CVE-2019-10481?
How severe is CVE-2019-10481?
How do I fix CVE-2019-10481?
How Strix Helps
- How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
- Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
- PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
- AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.
Related CVEs from 2019
- CVE-2019-10476Jenkins Zulip Plugin 1.1.0 and earlier stored credentials un…7.8
- CVE-2019-10477The FusionInventory plugin before 1.4 for GLPI 9.3.x and bef…
- CVE-2019-10478An issue was discovered on Glory RBW-100 devices with firmwa…
- CVE-2019-10479An issue was discovered on Glory RBW-100 devices with firmwa…
- CVE-2019-1048An information disclosure vulnerability exists when the Wind…4.7
- CVE-2019-10480Out of bound write can happen in WMI firmware event handler …7.8
- CVE-2019-10482Due to the use of non-time-constant comparison functions the…5.9
- CVE-2019-10483Side channel issue in QTEE due to usage of non-time-constant…5.5
- CVE-2019-10484Use after free issue occurs when command destructors access …5.5
- CVE-2019-10485Infinite loop while decoding compressed data can lead to ove…7.5
- CVE-2019-10486Race condition due to the lack of resource lock which will b…7
- CVE-2019-10487Buffer over read can happen while parsing SMS OTA messages a…9.8
Are you affected by CVE-2019-10481?
Run a free Strix scan to check your systems for this vulnerability.
Scan your code nowSource: NVD / NIST