Reddit NetSec

CVE Database V5

AlienVault OTX General

Reddit InfoSec News

Exploit-DB RSS Feed

ThreatFox MISP Feed

CIRCL OSINT Feed

AlienVault OTX Vulnerabilities

AlienVault OTX Malware

Transient DOS due to buffer over-read in WLAN firmware while processing PPE threshold. in Snapdragon Auto, Snapdragon Compute, Snapdragon Connectivity, Snapdragon Consumer Electronics Connectivity, Snapdragon Consumer IOT, Snapdragon Industrial IOT, Snapdragon Mobile, Snapdragon Voice & Music, Snapdragon Wearables, Snapdragon Wired Infrastructure and Networking

CVE-2022-33237 is a medium-severity vulnerability affecting a broad range of Qualcomm Snapdragon platforms, including Snapdragon Auto, Compute, Connectivity, Consumer Electronics Connectivity, Consumer IoT, Industrial IoT, Mobile, Voice & Music, Wearables, and Wired Infrastructure and Networking products. The vulnerability arises from a buffer over-read condition in the WLAN firmware component when processing the Packet Power Envelope (PPE) threshold. Specifically, the firmware improperly handles input data leading to reading beyond the allocated buffer boundaries (CWE-125). This flaw can cause transient denial of service (DoS) conditions by crashing or destabilizing the WLAN firmware, resulting in temporary loss of wireless connectivity. The affected devices span numerous Qualcomm chipsets and modules, including but not limited to IPQ series, QCA series, QCN series, QCS series, SD (Snapdragon) series, and WCD/WCN wireless components. The vulnerability does not require authentication or user interaction to be exploited, but it is limited to wireless network interactions targeting the vulnerable WLAN firmware. There are no known exploits in the wild as of the published date, and no patches or firmware updates have been linked or referenced in the provided information. The broad range of affected hardware indicates a widespread potential impact across multiple device categories, from mobile phones and wearables to automotive and industrial IoT devices. The transient nature of the DoS suggests that while the impact is disruptive, it is not permanent or leading to code execution or data compromise. However, the instability of wireless connectivity can have cascading effects on dependent systems and services.

Detailed information about CVE-2022-33237: Buffer over-read in WLAN in Qualcomm, Inc. Snapdragon Auto, Snapdragon Compute, Snapdragon Connectivity, Snapdragon C

CVE-2022-33237: Buffer over-read in WLAN in Qualcomm, Inc. Snapdragon Auto, Snapdragon Compute, Snapdragon Connectivity, Snapdragon Consumer Electronics Connectivity, Snapdragon Consumer IOT, Snapdragon Industrial IOT, Snapdragon Mobile, Snapdragon Voice & Music, Snapdragon Wearables, Snapdragon Wired Infrastructure and Networking - Live Threat Intelligence - Threat Radar | OffSeq.com

CVE-2022-33237: Buffer over-read in WLAN in Qualcomm, Inc. Snapdragon Auto, Snapdragon Compute, Snapdragon Connectivity, Snapdragon Consumer Electronics Connectivity, Snapdragon Consumer IOT, Snapdragon Industrial IOT, Snapdragon Mobile, Snapdragon Voice & Music, Snapdragon Wearables, Snapdragon Wired Infrastructure and Networking

Transient DOS due to buffer over-read in WLAN firmware while parsing cipher suite info attributes. in Snapdragon Compute, Snapdragon Connectivity, Snapdragon Mobile, Snapdragon Wired Infrastructure and Networking

CVE-2022-33236 is a medium-severity vulnerability affecting a wide range of Qualcomm Snapdragon platforms, including Snapdragon Compute, Connectivity, Mobile, Wired Infrastructure, and Networking products. The root cause is a buffer over-read in the WLAN firmware component, specifically when parsing cipher suite information attributes. This vulnerability is classified under CWE-125 (Out-of-bounds Read), which occurs when software reads data past the boundary of a buffer. In this case, the WLAN firmware improperly handles malformed or maliciously crafted cipher suite info attributes during wireless communication, leading to transient denial-of-service (DoS) conditions. The affected Qualcomm chipsets and modules include numerous IPQ series (e.g., IPQ5010, IPQ8070A), QCA series (e.g., QCA6390, QCA8081), QCN series, WCN series, and Snapdragon SoCs such as SD 8 Gen1 5G, SD865 5G, and SD870. The vulnerability manifests as a transient DoS, meaning the device or system experiences temporary disruption or crash of WLAN functionality but does not result in permanent damage or code execution. Exploitation does not require authentication but does require the attacker to be within wireless range to send crafted WLAN frames that trigger the buffer over-read. No known exploits are currently reported in the wild, and Qualcomm has not published patches at the time of this report. The vulnerability impacts confidentiality minimally but affects availability due to potential WLAN service disruption. The scope is broad given the extensive list of affected chipsets used in mobile devices, networking equipment, and infrastructure hardware. The ease of exploitation is moderate since proximity and crafted wireless frames are needed, but no user interaction or credentials are required.

Detailed information about CVE-2022-33236: Buffer over-read in WLAN in Qualcomm, Inc. Snapdragon Compute, Snapdragon Connectivity, Snapdragon Mobile, Snapdragon

CVE-2022-33236: Buffer over-read in WLAN in Qualcomm, Inc. Snapdragon Compute, Snapdragon Connectivity, Snapdragon Mobile, Snapdragon Wired Infrastructure and Networking - Live Threat Intelligence - Threat Radar | OffSeq.com

CVE-2022-33236: Buffer over-read in WLAN in Qualcomm, Inc. Snapdragon Compute, Snapdragon Connectivity, Snapdragon Mobile, Snapdragon Wired Infrastructure and Networking

Transient Denial-of-Service in WLAN due to buffer over-read while parsing MDNS frames. in Snapdragon Auto, Snapdragon Compute, Snapdragon Connectivity, Snapdragon Consumer Electronics Connectivity, Snapdragon Consumer IOT, Snapdragon Industrial IOT, Snapdragon IoT, Snapdragon Mobile, Snapdragon Voice & Music, Snapdragon Wearables, Snapdragon Wired Infrastructure and Networking

CVE-2022-25749 is a medium-severity vulnerability identified in a wide range of Qualcomm Snapdragon platforms, including Snapdragon Auto, Compute, Connectivity, Consumer Electronics Connectivity, Consumer IoT, Industrial IoT, IoT, Mobile, Voice & Music, Wearables, and Wired Infrastructure and Networking products. The vulnerability arises from a buffer over-read condition in the WLAN component when parsing Multicast DNS (mDNS) frames. Specifically, the flaw is a CWE-125 (Out-of-bounds Read) type, where the WLAN driver or firmware improperly handles mDNS packets, leading to reading beyond the allocated buffer boundaries. This can cause transient denial-of-service (DoS) conditions by crashing or destabilizing the WLAN subsystem. The affected Snapdragon chipsets and modules span a very broad range of Qualcomm’s product portfolio, including many popular mobile SoCs (e.g., SD 8 Gen1 5G, SD 888, SD 865 5G), IoT modules, automotive platforms, and connectivity chips. The vulnerability does not require authentication or user interaction, as it can be triggered remotely by sending specially crafted mDNS frames over the wireless network. There are no known exploits in the wild as of the published date (October 19, 2022), and Qualcomm has not provided public patches or mitigation instructions yet. The vulnerability’s root cause is in the WLAN firmware or driver’s parsing logic, which fails to validate the length or structure of mDNS frames properly, leading to buffer over-read and potential system instability or crashes. This transient DoS could disrupt wireless connectivity on affected devices, impacting availability of network services.

Detailed information about CVE-2022-25749: Buffer Over-read in WLAN in Qualcomm, Inc. Snapdragon Auto, Snapdragon Compute, Snapdragon Connectivity, Snapdragon C

CVE-2022-25749: Buffer Over-read in WLAN in Qualcomm, Inc. Snapdragon Auto, Snapdragon Compute, Snapdragon Connectivity, Snapdragon Consumer Electronics Connectivity, Snapdragon Consumer IOT, Snapdragon Industrial IOT, Snapdragon IoT, Snapdragon Mobile, Snapdragon Voice & Music, Snapdragon Wearables, Snapdragon Wired Infrastructure and Networking - Live Threat Intelligence - Threat Radar | OffSeq.com

CVE-2022-25749: Buffer Over-read in WLAN in Qualcomm, Inc. Snapdragon Auto, Snapdragon Compute, Snapdragon Connectivity, Snapdragon Consumer Electronics Connectivity, Snapdragon Consumer IOT, Snapdragon Industrial IOT, Snapdragon IoT, Snapdragon Mobile, Snapdragon Voice & Music, Snapdragon Wearables, Snapdragon Wired Infrastructure and Networking

Title	Severity	Type	Source	Date

Threats Tagged 'buffer-over-read-in-wlan'

Filter Threats

Threats Tagged 'buffer-over-read-in-wlan'

Keyboard Shortcuts

Navigation

Search & Filters

UI Controls

Accessibility