CVE-2021-1977
CRITICALCVSS 9.1/10EPSS 0.59%
Last modified
CVE-2021-1977 is a critical-severity vulnerability rated 9.1/10 on the CVSS scale. Possible buffer over read due to improper validation of frame length while processing AEAD decryption during ASSOC response in Snapdragon Auto, Snapdragon Compute, Snapdragon Connectivity, Snapdragon Consumer Electronics Connectivity, Snapdragon Consumer IOT, Snapdragon Industrial IOT, Snapdragon IoT, Snapdragon Mobile, Snapdragon Voice & Music. EPSS estimates a 0.59% chance of exploitation in the next 30 days.
Description
Possible buffer over read due to improper validation of frame length while processing AEAD decryption during ASSOC response in Snapdragon Auto, Snapdragon Compute, Snapdragon Connectivity, Snapdragon Consumer Electronics Connectivity, Snapdragon Consumer IOT, Snapdragon Industrial IOT, Snapdragon IoT, Snapdragon Mobile, Snapdragon Voice & Music
Metrics
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H
Weakness Enumeration
Affected Software
| Vendor | Product | Versions |
|---|---|---|
| Qualcomm | Apq8009 Firmware | All versions |
| Qualcomm | Apq8017 Firmware | All versions |
| Qualcomm | Apq8053 Firmware | All versions |
| Qualcomm | Apq8064au Firmware | All versions |
| Qualcomm | Apq8096au Firmware | All versions |
| Qualcomm | Ar8031 Firmware | All versions |
| Qualcomm | Ar8035 Firmware | All versions |
| Qualcomm | Csra6620 Firmware | All versions |
| Qualcomm | Csra6640 Firmware | All versions |
| Qualcomm | Csrb31024 Firmware | All versions |
| Qualcomm | Mdm9150 Firmware | All versions |
| Qualcomm | Mdm9206 Firmware | All versions |
| Qualcomm | Mdm9250 Firmware | All versions |
| Qualcomm | Mdm9607 Firmware | All versions |
| Qualcomm | Mdm9626 Firmware | All versions |
| Qualcomm | Mdm9628 Firmware | All versions |
| Qualcomm | Mdm9650 Firmware | All versions |
| Qualcomm | Msm8953 Firmware | All versions |
| Qualcomm | Msm8996au Firmware | All versions |
| Qualcomm | Qca4020 Firmware | All versions |
| Qualcomm | Qca6174a Firmware | All versions |
| Qualcomm | Qca6175a Firmware | All versions |
| Qualcomm | Qca6310 Firmware | All versions |
| Qualcomm | Qca6320 Firmware | All versions |
| Qualcomm | Qca6335 Firmware | All versions |
| Qualcomm | Qca6390 Firmware | All versions |
| Qualcomm | Qca6391 Firmware | All versions |
| Qualcomm | Qca6426 Firmware | All versions |
| Qualcomm | Qca6436 Firmware | All versions |
| Qualcomm | Qca6564a Firmware | All versions |
| Qualcomm | Qca6564au Firmware | All versions |
| Qualcomm | Qca6574 Firmware | All versions |
| Qualcomm | Qca6574a Firmware | All versions |
| Qualcomm | Qca6574au Firmware | All versions |
| Qualcomm | Qca6584au Firmware | All versions |
| Qualcomm | Qca6595 Firmware | All versions |
| Qualcomm | Qca6595au Firmware | All versions |
| Qualcomm | Qca6696 Firmware | All versions |
| Qualcomm | Qca8337 Firmware | All versions |
| Qualcomm | Qca9367 Firmware | All versions |
| Qualcomm | Qca9377 Firmware | All versions |
| Qualcomm | Qca9379 Firmware | All versions |
| Qualcomm | Qcm4290 Firmware | All versions |
| Qualcomm | Qcm6125 Firmware | All versions |
| Qualcomm | Qcs405 Firmware | All versions |
| Qualcomm | Qcs410 Firmware | All versions |
| Qualcomm | Qcs4290 Firmware | All versions |
| Qualcomm | Qcs603 Firmware | All versions |
| Qualcomm | Qcs605 Firmware | All versions |
| Qualcomm | Qcs610 Firmware | All versions |
Showing 50 of 128 affected configurations. See NVD for the full list.
References
- https://www.qualcomm.com/company/product-security/bulletins/october-2021-bulletinPatch, Vendor Advisory
- https://www.qualcomm.com/company/product-security/bulletins/october-2021-bulletinPatch, Vendor Advisory
Timeline
- Published
- Last Modified
- Status
- Modified
Frequently Asked Questions
What is CVE-2021-1977?
Possible buffer over read due to improper validation of frame length while processing AEAD decryption during ASSOC response in Snapdragon Auto, Snapdragon Compute, Snapdragon Connectivity, Snapdragon Consumer Electronics Connectivity, Snapdragon Consumer IOT, Snapdragon Industrial IOT, Snapdragon IoT, Snapdragon Mobile, Snapdragon Voice & Music
How severe is CVE-2021-1977?
CVE-2021-1977 has a CVSS score of 9.1/10 (CRITICAL severity). The EPSS model estimates a 0.59% probability of exploitation in the next 30 days.
How do I fix CVE-2021-1977?
Check the vendor references and advisories linked above for patched versions and mitigation guidance. You can also run a Strix scan to test if your systems are affected.
How Strix Helps
- How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
- Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
- PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
- AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.
Related CVEs from 2021
- CVE-2021-1971Possible assertion due to lack of physical layer state valid…7.5
- CVE-2021-1972Possible buffer overflow due to improper validation of devic…9.8
- CVE-2021-1973A FTM Diag command can allow an arbitrary write into modem O…7.8
- CVE-2021-1974Possible buffer over read due to lack of alignment between m…7.5
- CVE-2021-1975Possible heap overflow due to improper length check of domai…9.8
- CVE-2021-1976A use after free can occur due to improper validation of P2P…9.8
- CVE-2021-1979Possible buffer overflow due to improper validation of FTM c…7.8
- CVE-2021-1980Possible buffer over read due to lack of length check while …9.1
- CVE-2021-1981Possible buffer over read due to improper IE size check of B…9.1
- CVE-2021-1982Possible denial of service scenario due to improper input va…7.5
- CVE-2021-1983Possible buffer overflow due to improper handling of negativ…7.8
- CVE-2021-1984Possible buffer overflow due to improper validation of index…7.8
Are you affected by CVE-2021-1977?
Run a free Strix scan to check your systems for this vulnerability.
Scan your code nowSource: NVD / NIST