CVE-2022-25654
MEDIUMCVSS 6.7/10EPSS 0.11%
Last modified
CVE-2022-25654 is a medium-severity vulnerability rated 6.7/10 on the CVSS scale. Memory corruption in kernel due to improper input validation while processing ION commands in Snapdragon Auto, Snapdragon Connectivity, Snapdragon Consumer IOT, Snapdragon Industrial IOT, Snapdragon Wearables. EPSS estimates a 0.11% chance of exploitation in the next 30 days.
Description
Memory corruption in kernel due to improper input validation while processing ION commands in Snapdragon Auto, Snapdragon Connectivity, Snapdragon Consumer IOT, Snapdragon Industrial IOT, Snapdragon Wearables
Metrics
CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H
Weakness Enumeration
Affected Software
| Vendor | Product | Versions |
|---|---|---|
| Qualcomm | Apq8096au Firmware | All versions |
| Qualcomm | Mdm9650 Firmware | All versions |
| Qualcomm | Qca6174a Firmware | All versions |
| Qualcomm | Qca6574au Firmware | All versions |
| Qualcomm | Qcs603 Firmware | All versions |
| Qualcomm | Qcs605 Firmware | All versions |
| Qualcomm | Qualcomm215 Firmware | All versions |
| Qualcomm | Sd429 Firmware | All versions |
| Qualcomm | Sd820 Firmware | All versions |
| Qualcomm | Sdm429w Firmware | All versions |
| Qualcomm | Wcd9326 Firmware | All versions |
| Qualcomm | Wcd9335 Firmware | All versions |
| Qualcomm | Wcd9341 Firmware | All versions |
| Qualcomm | Wcn3615 Firmware | All versions |
| Qualcomm | Wcn3620 Firmware | All versions |
| Qualcomm | Wcn3660b Firmware | All versions |
| Qualcomm | Wcn3680 Firmware | All versions |
| Qualcomm | Wcn3980 Firmware | All versions |
| Qualcomm | Wcn3990 Firmware | All versions |
| Qualcomm | Wsa8810 Firmware | All versions |
| Qualcomm | Wsa8815 Firmware | All versions |
References
- https://www.qualcomm.com/company/product-security/bulletins/september-2022-bulletinPatch, Vendor Advisory
- https://www.qualcomm.com/company/product-security/bulletins/september-2022-bulletinPatch, Vendor Advisory
Timeline
- Published
- Last Modified
- Status
- Modified
Frequently Asked Questions
What is CVE-2022-25654?
Memory corruption in kernel due to improper input validation while processing ION commands in Snapdragon Auto, Snapdragon Connectivity, Snapdragon Consumer IOT, Snapdragon Industrial IOT, Snapdragon Wearables
How severe is CVE-2022-25654?
CVE-2022-25654 has a CVSS score of 6.7/10 (MEDIUM severity). The EPSS model estimates a 0.11% probability of exploitation in the next 30 days.
How do I fix CVE-2022-25654?
Check the vendor references and advisories linked above for patched versions and mitigation guidance. You can also run a Strix scan to test if your systems are affected.
How Strix Helps
- How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
- Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
- PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
- AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.
Related CVEs from 2022
- CVE-2022-25649Multiple Improper Access Control vulnerabilities in StoreApp…8.8
- CVE-2022-2565The Simple Payment Donations & Subscriptions WordPress plugi…7.2
- CVE-2022-25650A vulnerability has been identified in Mendix Applications u…6.5
- CVE-2022-25651Memory corruption in bluetooth host due to integer overflow …9.8
- CVE-2022-25652Cryptographic issues in BSP due to improper hash verificatio…7.8
- CVE-2022-25653Information disclosure in video due to buffer over-read whil…5.5
- CVE-2022-25655Memory corruption in WLAN HAL while arbitrary value is passe…7.8
- CVE-2022-25656Possible integer overflow and memory corruption due to impro…7.8
- CVE-2022-25657Memory corruption due to buffer overflow occurs while proces…9.8
- CVE-2022-25658Memory corruption due to incorrect pointer arithmetic when a…9.8
- CVE-2022-25659Memory corruption due to buffer overflow while parsing MKV c…9.8
- CVE-2022-2566A heap out-of-bounds memory write exists in FFMPEG since ver…7.8
Are you affected by CVE-2022-25654?
Run a free Strix scan to check your systems for this vulnerability.
Scan your code nowSource: NVD / NIST