Lucene search

VDOOCVE-2020-25858

HistoryOct 15, 2020 - 4:15 p.m.

CVE-2020-25858

2020-10-1516:15:12

CWE-476

VDOO

web.nvd.nist.gov

cve-2020-25858

qcmap

qualcomm

software vulnerability

web interface

denial of service

networking devices

mobile hotspots

lte routers

nvd

CVSS2

Attack Vector

NETWORK

Attack Complexity

LOW

Authentication

NONE

Confidentiality Impact

NONE

Integrity Impact

NONE

Availability Impact

PARTIAL

AV:N/AC:L/Au:N/C:N/I:N/A:P

CVSS3

7.5

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

NONE

Integrity Impact

NONE

Availability Impact

HIGH

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

AI Score

7.3

Confidence

High

EPSS

0.001

Percentile

45.3%

JSON

The QCMAP_Web_CLIENT binary in the Qualcomm QCMAP software suite prior to versions released in October 2020 does not validate the return value of a strstr() or strchr() call in the Tokenizer() function. An attacker who invokes the web interface with a crafted URL can crash the process, causing denial of service. This version of QCMAP is used in many kinds of networking devices, primarily mobile hotspots and LTE routers.

Affected configurations

Nvd

Node

qualcommqualcomm_mobile_access_pointMatch-

VendorProductVersionCPE
qualcommqualcomm_mobile_access_point-cpe:2.3:a:qualcomm:qualcomm_mobile_access_point:-:*:*:*:*:*:*:*

Vendor	Product	Version	CPE
qualcomm	qualcomm_mobile_access_point	-	cpe:2.3:a:qualcomm:qualcomm_mobile_access_point:-:::::::*

CNA Affected

[
  {
    "product": "Qualcomm QCMAP",
    "vendor": "n/a",
    "versions": [
      {
        "status": "affected",
        "version": "Fixed in October 2020"
      }
    ]
  }
]

References

vdoo.com/blog/qualcomm-qcmap-vulnerabilities

CVSS2

Attack Vector

NETWORK

Attack Complexity

LOW

Authentication

NONE

Confidentiality Impact

NONE

Integrity Impact

NONE

Availability Impact

PARTIAL

AV:N/AC:L/Au:N/C:N/I:N/A:P

CVSS3

7.5

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

NONE

Integrity Impact

NONE

Availability Impact

HIGH

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

AI Score

7.3

Confidence

High

EPSS

0.001

Percentile

45.3%

JSON

Related for CVE-2020-25858