CVE-2019-10510
Last modified
CVE-2019-10510 is a high-severity vulnerability rated 8.2/10 on the CVSS scale. BT process died and BT toggled due to null pointer dereference when invalid vendor pass through command sent from remote in Snapdragon Auto, Snapdragon Consumer IOT, Snapdragon Mobile, Snapdragon Voice & Music in QCS405, QCS605, SD 636, SD 675, SD 730, SD 820A, SD 835, SD 845 / SD 850, SD 855, SDM630, SDM660. EPSS estimates a 0.69% chance of exploitation in the next 30 days.
Description
BT process died and BT toggled due to null pointer dereference when invalid vendor pass through command sent from remote in Snapdragon Auto, Snapdragon Consumer IOT, Snapdragon Mobile, Snapdragon Voice & Music in QCS405, QCS605, SD 636, SD 675, SD 730, SD 820A, SD 835, SD 845 / SD 850, SD 855, SDM630, SDM660
Metrics
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:H
Weakness Enumeration
Affected Software
| Vendor | Product | Versions |
|---|---|---|
| Qualcomm | Qcs405 Firmware | All versions |
| Qualcomm | Qcs605 Firmware | All versions |
| Qualcomm | Sd 636 Firmware | All versions |
| Qualcomm | Sd 675 Firmware | All versions |
| Qualcomm | Sd 730 Firmware | All versions |
| Qualcomm | Sd 820a Firmware | All versions |
| Qualcomm | Sd 835 Firmware | All versions |
| Qualcomm | Sd 845 Firmware | All versions |
| Qualcomm | Sd 850 Firmware | All versions |
| Qualcomm | Sd 855 Firmware | All versions |
| Qualcomm | Sdm630 Firmware | All versions |
| Qualcomm | Sdm660 Firmware | All versions |
References
- https://www.codeaurora.org/security-bulletin/2019/08/05/august-2019-code-aurora-security-bulletinPatch, Third Party Advisory
- https://www.codeaurora.org/security-bulletin/2019/08/05/august-2019-code-aurora-security-bulletinPatch, Third Party Advisory
Timeline
- Published
- Last Modified
- Status
- Modified
Frequently Asked Questions
What is CVE-2019-10510?
How severe is CVE-2019-10510?
How do I fix CVE-2019-10510?
How Strix Helps
- How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
- Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
- PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
- AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.
Related CVEs from 2019
- CVE-2019-10505Out of bound access while processing a non-standard IE measu…9.8
- CVE-2019-10506While processing QCA_NL80211_VENDOR_SUBCMD_AVOID_FREQUENCY v…7.8
- CVE-2019-10507Lack of check of extscan change results received from firmwa…7.8
- CVE-2019-10508Lack of input validation for data received from user space c…7.8
- CVE-2019-10509Device record of the pairing device used after free during A…9.8
- CVE-2019-1051A remote code execution vulnerability exists in the way that…4.2
- CVE-2019-10511Possibility of memory overflow while decoding GSNDCP compres…9.8
- CVE-2019-10512Payload size is not checked before using it as array index i…7.8
- CVE-2019-10513Possibility of Null pointer access if the SPDM commands are …5.5
- CVE-2019-10515DCI client which might be preemptively freed up might be acc…5.5
- CVE-2019-10516Multiple read overflows in MM while decoding service accept,…9.8
- CVE-2019-10517Memory is being freed up twice when two concurrent threads a…7.8
Are you affected by CVE-2019-10510?
Run a free Strix scan to check your systems for this vulnerability.
Scan your code nowSource: NVD / NIST