CVE-2022-25702: Reachable Assertion in Modem in Qualcomm, Inc. Snapdragon Auto, Snapdragon Compute, Snapdragon Industrial IOT, Snapdragon Mobile, Snapdragon Wearables
Denial of service in modem due to reachable assertion while processing reconfiguration message in Snapdragon Auto, Snapdragon Compute, Snapdragon Industrial IOT, Snapdragon Mobile, Snapdragon Wearables
AI Analysis
Technical Summary
CVE-2022-25702 is a medium-severity vulnerability affecting a broad range of Qualcomm Snapdragon platforms, including Snapdragon Auto, Compute, Industrial IoT, Mobile, and Wearables. The vulnerability arises from a reachable assertion failure within the modem subsystem when processing a reconfiguration message. Specifically, the modem firmware encounters an assertion condition that can be triggered by crafted reconfiguration messages, leading to a denial of service (DoS) condition. This causes the modem to crash or become unresponsive, disrupting cellular connectivity and potentially impacting device functionality. The affected Snapdragon platforms span a wide array of chipsets, including but not limited to APQ, MSM, QCA, SD, SM, WCD, WCN, and WSA series, covering many generations and device types. The vulnerability is categorized under CWE-617 (Reachable Assertion), indicating that the assertion can be triggered by external input, which in this case is the reconfiguration message processed by the modem. No known exploits have been reported in the wild, and no patches or mitigation details have been publicly disclosed by Qualcomm at the time of this report. The vulnerability does not require user interaction but does require the attacker to send a specially crafted reconfiguration message to the modem, which may be feasible in certain network or device contexts. The impact is primarily a denial of service affecting modem availability, which can disrupt voice, data, and other cellular services dependent on the modem's operation.
Potential Impact
For European organizations, the impact of CVE-2022-25702 can be significant, especially for sectors relying heavily on mobile connectivity and IoT devices. Industries such as automotive (connected cars using Snapdragon Auto), industrial automation (Snapdragon Industrial IoT), mobile communications, and wearable technology may experience service disruptions due to modem failures. Denial of service in modems can lead to loss of critical communications, affecting operational continuity, safety systems in automotive contexts, and real-time data transmission in industrial environments. Enterprises deploying Snapdragon-based devices for remote monitoring or mobile workforce connectivity could face interruptions, impacting productivity and potentially causing financial losses. Additionally, the widespread use of affected Snapdragon chipsets in consumer mobile devices across Europe means that large user bases could experience network outages or degraded service quality, indirectly affecting business operations and customer satisfaction. The lack of known exploits reduces immediate risk, but the broad device footprint and critical role of modems in connectivity elevate the threat's potential impact. Furthermore, disruption in communication infrastructure could have cascading effects on emergency services, logistics, and supply chain operations within European countries.
Mitigation Recommendations
Given the absence of publicly available patches, European organizations should implement targeted mitigations beyond generic advice. First, network operators and device manufacturers should prioritize monitoring for anomalous reconfiguration messages that could trigger the assertion failure, employing deep packet inspection and anomaly detection tools within cellular networks. Deploying network-level filtering to block malformed or suspicious reconfiguration messages can reduce exposure. Organizations should engage with Qualcomm and device vendors to obtain firmware updates or patches as soon as they become available and plan for timely deployment. For critical infrastructure and automotive systems, implementing redundancy in communication modules and failover mechanisms can mitigate the impact of modem outages. Additionally, organizations should conduct thorough inventory assessments to identify devices with affected Snapdragon chipsets and evaluate their exposure based on deployment scenarios. For IoT and industrial environments, segmenting networks and restricting access to modem interfaces can limit attack vectors. Finally, maintaining up-to-date device firmware and applying security best practices for device management will help reduce the attack surface.
Affected Countries
Germany, France, United Kingdom, Italy, Spain, Netherlands, Sweden, Finland, Belgium, Poland
CVE-2022-25702: Reachable Assertion in Modem in Qualcomm, Inc. Snapdragon Auto, Snapdragon Compute, Snapdragon Industrial IOT, Snapdragon Mobile, Snapdragon Wearables
Description
Denial of service in modem due to reachable assertion while processing reconfiguration message in Snapdragon Auto, Snapdragon Compute, Snapdragon Industrial IOT, Snapdragon Mobile, Snapdragon Wearables
AI-Powered Analysis
Technical Analysis
CVE-2022-25702 is a medium-severity vulnerability affecting a broad range of Qualcomm Snapdragon platforms, including Snapdragon Auto, Compute, Industrial IoT, Mobile, and Wearables. The vulnerability arises from a reachable assertion failure within the modem subsystem when processing a reconfiguration message. Specifically, the modem firmware encounters an assertion condition that can be triggered by crafted reconfiguration messages, leading to a denial of service (DoS) condition. This causes the modem to crash or become unresponsive, disrupting cellular connectivity and potentially impacting device functionality. The affected Snapdragon platforms span a wide array of chipsets, including but not limited to APQ, MSM, QCA, SD, SM, WCD, WCN, and WSA series, covering many generations and device types. The vulnerability is categorized under CWE-617 (Reachable Assertion), indicating that the assertion can be triggered by external input, which in this case is the reconfiguration message processed by the modem. No known exploits have been reported in the wild, and no patches or mitigation details have been publicly disclosed by Qualcomm at the time of this report. The vulnerability does not require user interaction but does require the attacker to send a specially crafted reconfiguration message to the modem, which may be feasible in certain network or device contexts. The impact is primarily a denial of service affecting modem availability, which can disrupt voice, data, and other cellular services dependent on the modem's operation.
Potential Impact
For European organizations, the impact of CVE-2022-25702 can be significant, especially for sectors relying heavily on mobile connectivity and IoT devices. Industries such as automotive (connected cars using Snapdragon Auto), industrial automation (Snapdragon Industrial IoT), mobile communications, and wearable technology may experience service disruptions due to modem failures. Denial of service in modems can lead to loss of critical communications, affecting operational continuity, safety systems in automotive contexts, and real-time data transmission in industrial environments. Enterprises deploying Snapdragon-based devices for remote monitoring or mobile workforce connectivity could face interruptions, impacting productivity and potentially causing financial losses. Additionally, the widespread use of affected Snapdragon chipsets in consumer mobile devices across Europe means that large user bases could experience network outages or degraded service quality, indirectly affecting business operations and customer satisfaction. The lack of known exploits reduces immediate risk, but the broad device footprint and critical role of modems in connectivity elevate the threat's potential impact. Furthermore, disruption in communication infrastructure could have cascading effects on emergency services, logistics, and supply chain operations within European countries.
Mitigation Recommendations
Given the absence of publicly available patches, European organizations should implement targeted mitigations beyond generic advice. First, network operators and device manufacturers should prioritize monitoring for anomalous reconfiguration messages that could trigger the assertion failure, employing deep packet inspection and anomaly detection tools within cellular networks. Deploying network-level filtering to block malformed or suspicious reconfiguration messages can reduce exposure. Organizations should engage with Qualcomm and device vendors to obtain firmware updates or patches as soon as they become available and plan for timely deployment. For critical infrastructure and automotive systems, implementing redundancy in communication modules and failover mechanisms can mitigate the impact of modem outages. Additionally, organizations should conduct thorough inventory assessments to identify devices with affected Snapdragon chipsets and evaluate their exposure based on deployment scenarios. For IoT and industrial environments, segmenting networks and restricting access to modem interfaces can limit attack vectors. Finally, maintaining up-to-date device firmware and applying security best practices for device management will help reduce the attack surface.
For access to advanced analysis and higher rate limits, contact root@offseq.com
Technical Details
- Data Version
- 5.1
- Assigner Short Name
- qualcomm
- Date Reserved
- 2022-02-22T00:00:00.000Z
- Cisa Enriched
- true
Threat ID: 682d9849c4522896dcbf6e46
Added to database: 5/21/2025, 9:09:29 AM
Last enriched: 6/21/2025, 8:22:09 PM
Last updated: 8/12/2025, 2:41:46 AM
Views: 13
Related Threats
CVE-2025-8914: CWE-89 Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') in WellChoose Organization Portal System
HighCVE-2025-8913: CWE-98 Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') in WellChoose Organization Portal System
CriticalCVE-2025-8912: CWE-36 Absolute Path Traversal in WellChoose Organization Portal System
HighCVE-2025-8911: CWE-79 Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') in WellChoose Organization Portal System
MediumCVE-2025-8910: CWE-79 Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') in WellChoose Organization Portal System
MediumActions
Updates to AI analysis are available only with a Pro account. Contact root@offseq.com for access.
External Links
Need enhanced features?
Contact root@offseq.com for Pro access with improved analysis and higher rate limits.