CVE-2019-10535
Last modified
CVE-2019-10535 is a medium-severity vulnerability rated 5.5/10 on the CVSS scale. Improper validation for loop variable received from firmware can lead to out of bound access in WLAN function while iterating through loop in Snapdragon Auto, Snapdragon Compute, Snapdragon Consumer Electronics Connectivity, Snapdragon Consumer IOT, Snapdragon Industrial IOT, Snapdragon Mobile, Snapdragon Voice & Music in APQ8053, APQ8096AU, APQ8098, MDM9640, MSM8996AU, MSM8998, QCA6574AU, QCN7605, QCS405, QCS605, SDA845, SDM845, SDX20. EPSS estimates a 0.17% chance of exploitation in the next 30 days.
Description
Improper validation for loop variable received from firmware can lead to out of bound access in WLAN function while iterating through loop in Snapdragon Auto, Snapdragon Compute, Snapdragon Consumer Electronics Connectivity, Snapdragon Consumer IOT, Snapdragon Industrial IOT, Snapdragon Mobile, Snapdragon Voice & Music in APQ8053, APQ8096AU, APQ8098, MDM9640, MSM8996AU, MSM8998, QCA6574AU, QCN7605, QCS405, QCS605, SDA845, SDM845, SDX20
Metrics
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
Weakness Enumeration
Affected Software
| Vendor | Product | Versions |
|---|---|---|
| Qualcomm | Apq8053 Firmware | All versions |
| Qualcomm | Apq8096au Firmware | All versions |
| Qualcomm | Apq8098 Firmware | All versions |
| Qualcomm | Mdm9640 Firmware | All versions |
| Qualcomm | Msm8996au Firmware | All versions |
| Qualcomm | Msm8998 Firmware | All versions |
| Qualcomm | Qca6574au Firmware | All versions |
| Qualcomm | Qcn7605 Firmware | All versions |
| Qualcomm | Qcs405 Firmware | All versions |
| Qualcomm | Qcs605 Firmware | All versions |
| Qualcomm | Sda845 Firmware | All versions |
| Qualcomm | Sdm845 Firmware | All versions |
| Qualcomm | Sdx20 Firmware | All versions |
References
- https://www.qualcomm.com/company/product-security/bulletins/october-2019-bulletinPatch, Vendor Advisory
- https://www.qualcomm.com/company/product-security/bulletins/october-2019-bulletinPatch, Vendor Advisory
Timeline
- Published
- Last Modified
- Status
- Modified
Frequently Asked Questions
What is CVE-2019-10535?
How severe is CVE-2019-10535?
How do I fix CVE-2019-10535?
How Strix Helps
- How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
- Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
- PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
- AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.
Related CVEs from 2019
- CVE-2019-1053An elevation of privilege vulnerability exists when the Wind…6.3
- CVE-2019-10530Lack of check of data truncation on user supplied data in ke…7.8
- CVE-2019-10531Incorrect reading of system image resulting in buffer overfl…9.8
- CVE-2019-10532Null-pointer dereference issue can occur while calculating s…9.8
- CVE-2019-10533Out of bound access due to improper validation of array inde…9.8
- CVE-2019-10534Null-pointer dereference can occur while accessing the super…9.8
- CVE-2019-10536Potential double free scenario if driver receives another DI…7.8
- CVE-2019-10537Improper validation of event buffer extracted from FW respon…7.8
- CVE-2019-10538Lack of check of address range received from firmware respon…9.8
- CVE-2019-10539Possible buffer overflow issue due to lack of length check w…9.8
- CVE-2019-1054A security feature bypass vulnerability exists in Edge that …5
- CVE-2019-10540Buffer overflow in WLAN NAN function due to lack of check of…9.8
Are you affected by CVE-2019-10535?
Run a free Strix scan to check your systems for this vulnerability.
Scan your code nowSource: NVD / NIST