CVE-2018-13904 — CRITICAL (9.8)

Vulnerability Description

Improper input validation in SCM handler to access storage in TZ can lead to unauthorized access in Snapdragon Auto, Snapdragon Compute, Snapdragon Consumer Electronics Connectivity, Snapdragon Consumer IOT, Snapdragon Industrial IOT, Snapdragon Mobile in versions MDM9206, MDM9607, MDM9650, MDM9655, QCS605, SD 410/12, SD 675, SD 712 / SD 710 / SD 670, SD 8CX, SXR1130.

CVSS Score

9.8

CRITICAL

CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality

HIGH

Integrity

HIGH

Availability

HIGH

Affected Products

Vendor	Product	Versions
Qualcomm	Mdm9206 Firmware	-
Qualcomm	Mdm9206	-
Qualcomm	Mdm9607 Firmware	-
Qualcomm	Mdm9607	-
Qualcomm	Mdm9650 Firmware	-
Qualcomm	Mdm9650	-
Qualcomm	Mdm9655 Firmware	-
Qualcomm	Mdm9655	-
Qualcomm	Qcs605 Firmware	-
Qualcomm	Qcs605	-
Qualcomm	Sd 410 Firmware	-
Qualcomm	Sd 410	-
Qualcomm	Sd 12 Firmware	-
Qualcomm	Sd 12	-
Qualcomm	Sd 675 Firmware	-
Qualcomm	Sd 675	-
Qualcomm	Sd 712 Firmware	-
Qualcomm	Sd 712	-
Qualcomm	Sd 710 Firmware	-
Qualcomm	Sd 710	-

Related Weaknesses (CWE)

CWE-20

References

http://www.securityfocus.com/bid/106845Third Party AdvisoryVDB Entry
https://www.qualcomm.com/company/product-security/bulletinsVendor Advisory
http://www.securityfocus.com/bid/106845Third Party AdvisoryVDB Entry
https://www.qualcomm.com/company/product-security/bulletinsVendor Advisory

FAQ

What is CVE-2018-13904?

CVE-2018-13904 is a vulnerability with a CVSS score of 9.8 (CRITICAL). Improper input validation in SCM handler to access storage in TZ can lead to unauthorized access in Snapdragon Auto, Snapdragon Compute, Snapdragon Consumer Electronics Connectivity, Snapdragon Consum...

How severe is CVE-2018-13904?

CVE-2018-13904 has been rated CRITICAL with a CVSS base score of 9.8/10. This is considered a critical vulnerability requiring immediate attention.

Is there a patch for CVE-2018-13904?

Check the references section above for vendor advisories and patch information. Affected products include: Qualcomm Mdm9206 Firmware, Qualcomm Mdm9206, Qualcomm Mdm9607 Firmware, Qualcomm Mdm9607, Qualcomm Mdm9650 Firmware.