CVE-2020-11286 — MEDIUM (6.8)

Vulnerability Description

An Untrusted Pointer Dereference can occur while doing USB control transfers, if multiple requests of different standard request categories like device, interface & endpoint are made together. in Snapdragon Auto, Snapdragon Consumer IOT, Snapdragon Industrial IOT, Snapdragon Mobile, Snapdragon Voice & Music, Snapdragon Wearables

CVSS Score

6.8

MEDIUM

CVSS:3.1/AV:P/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Attack Vector

PHYSICAL

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality

HIGH

Integrity

HIGH

Availability

HIGH

Affected Products

Vendor	Product	Versions
Qualcomm	Apq8009	-
Qualcomm	Apq8009W	-
Qualcomm	Apq8017	-
Qualcomm	Apq8053	-
Qualcomm	Apq8064Au	-
Qualcomm	Apq8076	-
Qualcomm	Apq8096Au	-
Qualcomm	Ar8151	-
Qualcomm	Csr6030	-
Qualcomm	Mdm9206	-
Qualcomm	Mdm9230	-
Qualcomm	Mdm9250	-
Qualcomm	Mdm9330	-
Qualcomm	Mdm9607	-
Qualcomm	Mdm9626	-
Qualcomm	Mdm9628	-
Qualcomm	Mdm9630	-
Qualcomm	Mdm9640	-
Qualcomm	Mdm9650	-
Qualcomm	Mdm9655	-

Related Weaknesses (CWE)

CWE-119

References

https://www.qualcomm.com/company/product-security/bulletins/february-2021-bulletPatchVendor Advisory
https://www.qualcomm.com/company/product-security/bulletins/february-2021-bulletPatchVendor Advisory

FAQ

What is CVE-2020-11286?

CVE-2020-11286 is a vulnerability with a CVSS score of 6.8 (MEDIUM). An Untrusted Pointer Dereference can occur while doing USB control transfers, if multiple requests of different standard request categories like device, interface & endpoint are made together. in Snap...

How severe is CVE-2020-11286?

CVE-2020-11286 has been rated MEDIUM with a CVSS base score of 6.8/10. Review the CVSS metrics above for detailed severity breakdown.

Is there a patch for CVE-2020-11286?

Check the references section above for vendor advisories and patch information. Affected products include: Qualcomm Apq8009, Qualcomm Apq8009W, Qualcomm Apq8017, Qualcomm Apq8053, Qualcomm Apq8064Au.