Qts110 Firmware Security Vulnerabilities

CVE-2022-22076

information disclosure due to cryptographic issue in Core during RPMB read request.

CVE-2022-25678

Memory correction in modem due to buffer overwrite during coap connection

CVE-2022-25694

Memory corruption in Modem due to usage of Out-of-range pointer offset in UIM

CVE-2022-25705

Memory corruption in modem due to integer overflow to buffer overflow while handling APDU response

CVE-2022-25726

Information disclosure in modem data due to array out of bound access while handling the incoming DNS response packet

CVE-2022-25728

Information disclosure in modem due to buffer over-read while processing response from DNS server

CVE-2022-25729

Memory corruption in modem due to improper length check while copying into memory

CVE-2022-25730

Information disclosure in modem due to improper check of IP type while processing DNS server query

CVE-2022-25731

Information disclosure in modem due to buffer over-read while processing packets from DNS server

CVE-2022-25732

Information disclosure in modem due to buffer over read in dns client due to missing length check

CVE-2022-25733

Denial of service in modem due to null pointer dereference while processing DNS packets

CVE-2022-25734

Denial of service in modem due to missing null check while processing IP packets with padding

CVE-2022-25735

Denial of service in modem due to missing null check while processing TCP or UDP packets from server

CVE-2022-25737

Information disclosure in modem due to missing NULL check while reading packets received from local network

CVE-2022-25738

Information disclosure in modem due to buffer over-red while performing checksum of packet received

CVE-2022-25739

Denial of service in modem due to missing null check while processing the ipv6 packet received during ECM call

CVE-2022-25740

Memory corruption in modem due to buffer overwrite while building an IPv6 multicast address based on the MAC address of the iface

CVE-2022-25745

Memory corruption in modem due to improper input validation while handling the incoming CoAP message

CVE-2022-25747

Information disclosure in modem due to improper input validation during parsing of upcoming CoAP message

CVE-2022-33211

memory corruption in modem due to improper check while calculating size of serialized CoAP message

CVE-2022-33213

Memory corruption in modem due to buffer overflow while processing a PPP packet

CVE-2022-33222

Information disclosure due to buffer over-read while parsing DNS response packets in Modem.

CVE-2022-33223

Transient DOS in Modem due to null pointer dereference while processing the incoming packet with http chunked encoding.

CVE-2022-33228

Information disclosure sue to buffer over-read in modem while processing ipv6 packet with hop-by-hop or destination option in header.

CVE-2022-33229

Information disclosure due to buffer over-read in Modem while using static array to process IPv4 packets.

CVE-2022-33231

Memory corruption due to double free in core while initializing the encryption key.

CVE-2022-33233

Memory corruption due to configuration weakness in modem wile sending command to write protected files.

CVE-2022-33258

Information disclosure due to buffer over-read in modem while reading configuration parameters.

CVE-2022-33259

Memory corruption due to buffer copy without checking the size of input in modem while decoding raw SMS received.

CVE-2022-33287

Information disclosure in Modem due to buffer over-read while getting length of Unfragmented headers in an IPv6 packet.

CVE-2022-33289

Memory corruption occurs in Modem due to improper validation of array index when malformed APDU is sent from card.

CVE-2022-33291

Information disclosure in Modem due to buffer over-read while receiving a IP header with malformed length.

CVE-2022-33294

Transient DOS in Modem due to NULL pointer dereference while receiving response of lwm2m registration/update/bootstrap request message.

CVE-2022-33295

Information disclosure in Modem due to buffer over-read while parsing the wms message received given the buffer and its length.

CVE-2022-33302

Memory corruption due to improper validation of array index in User Identity Module when APN TLV length is greater than command length.

CVE-2022-33304

Transient DOS due to NULL pointer dereference in Modem while performing pullup for received TCP/UDP packet.

CVE-2022-40505

Information disclosure due to buffer over-read in Modem while parsing DNS hostname.

CVE-2022-40507

Memory corruption due to double free in Core while mapping HLOS address to the list.

CVE-2022-40521

Transient DOS due to improper authorization in Modem

CVE-2022-40531

Memory corruption in WLAN due to incorrect type cast while sending WMI_SCAN_SCH_PRIO_TBL_CMDID message.

CVE-2022-40532

Memory corruption due to integer overflow or wraparound in WLAN while sending WMI cmd from host to target.

CVE-2023-21625

Information disclosure in Network Services due to buffer over-read while the device receives DNS response.

CVE-2023-21631

Weak Configuration due to improper input validation in Modem while processing LTE security mode command message received from network.

CVE-2023-22385

Memory Corruption in Data Modem while making a MO call or MT VOLTE call.

CVE-2023-22388

Memory Corruption in Multi-mode Call Processor while processing bit mask API.

CVE-2023-24852

Memory Corruption in Core due to secure memory access by user while loading modem image.

CVE-2023-28546

Memory Corruption in SPS Application while exporting public key in sorter TA.

CVE-2023-28550

Memory corruption in MPP performance while accessing DSM watermark using external memory address.

CVE-2023-28551

Memory corruption in UTILS when modem processes memory specific Diag commands having arbitrary address values as input arguments.

CVE-2023-28556

Cryptographic issue in HLOS during key management.