CVE-2018-11290 : In Snapdragon (Automobile, Mobile, Wear) in version MDM9206, MDM9607, MDM9640, M

In Snapdragon (Automobile, Mobile, Wear) in version MDM9206, MDM9607, MDM9640, MDM9650, MSM8996AU, QCA6574AU, QCA6584, SD 210/SD 212/SD 205, SD 425, SD 427, SD 430, SD 435, SD 450, SD 625, SD 650/52, SD 820A, SD 845, SDM429, SDM439, SDM630, SDM632, SDM636, SDM660, SDX20, Snapdragon_High_Med_2016, MAC address randomization performed during probe requests is not done properly due to a flawed RNG in use.

Published 2018-09-20 13:29:02

Updated 2019-10-03 00:03:26

Source Qualcomm, Inc.

View at NVD, CVE.org

Products affected by CVE-2018-11290

Qualcomm » Mdm9206 Firmware » Version: N/A
cpe:2.3:o:qualcomm:mdm9206_firmware:-:*:*:*:*:*:*:*
Matching versions
When used together with: Qualcomm » Mdm9206 » Version: N/A
Qualcomm » Mdm9607 Firmware » Version: N/A
cpe:2.3:o:qualcomm:mdm9607_firmware:-:*:*:*:*:*:*:*
Matching versions
When used together with: Qualcomm » Mdm9607 » Version: N/A
Qualcomm » Mdm9650 Firmware » Version: N/A
cpe:2.3:o:qualcomm:mdm9650_firmware:-:*:*:*:*:*:*:*
Matching versions
When used together with: Qualcomm » Mdm9650 » Version: N/A
Qualcomm » Mdm9640 Firmware » Version: N/A
cpe:2.3:o:qualcomm:mdm9640_firmware:-:*:*:*:*:*:*:*
Matching versions
When used together with: Qualcomm » Mdm9640 » Version: N/A
Qualcomm » Sdx20 Firmware » Version: N/A
cpe:2.3:o:qualcomm:sdx20_firmware:-:*:*:*:*:*:*:*
Matching versions
When used together with: Qualcomm » Sdx20 » Version: N/A
Qualcomm » Sdm630 Firmware » Version: N/A
cpe:2.3:o:qualcomm:sdm630_firmware:-:*:*:*:*:*:*:*
Matching versions
When used together with: Qualcomm » Sdm630 » Version: N/A
Qualcomm » Sdm636 Firmware » Version: N/A
cpe:2.3:o:qualcomm:sdm636_firmware:-:*:*:*:*:*:*:*
Matching versions
When used together with: Qualcomm » Sdm636 » Version: N/A
Qualcomm » Sdm660 Firmware » Version: N/A
cpe:2.3:o:qualcomm:sdm660_firmware:-:*:*:*:*:*:*:*
Matching versions
When used together with: Qualcomm » Sdm660 » Version: N/A
Qualcomm » Msm8996au Firmware » Version: N/A
cpe:2.3:o:qualcomm:msm8996au_firmware:-:*:*:*:*:*:*:*
Matching versions
When used together with: Qualcomm » Msm8996au » Version: N/A
Qualcomm » Qca6574au Firmware » Version: N/A
cpe:2.3:o:qualcomm:qca6574au_firmware:-:*:*:*:*:*:*:*
Matching versions
When used together with: Qualcomm » Qca6574au » Version: N/A
Qualcomm » Qca6584 Firmware » Version: N/A
cpe:2.3:o:qualcomm:qca6584_firmware:-:*:*:*:*:*:*:*
Matching versions
When used together with: Qualcomm » Qca6584 » Version: N/A
Qualcomm » Sdm632 Firmware » Version: N/A
cpe:2.3:o:qualcomm:sdm632_firmware:-:*:*:*:*:*:*:*
Matching versions
When used together with: Qualcomm » Sdm632 » Version: N/A
Qualcomm » Sd210 Firmware » Version: N/A
cpe:2.3:o:qualcomm:sd210_firmware:-:*:*:*:*:*:*:*
Matching versions
When used together with: Qualcomm » Sd210 » Version: N/A
Qualcomm » Sd212 Firmware » Version: N/A
cpe:2.3:o:qualcomm:sd212_firmware:-:*:*:*:*:*:*:*
Matching versions
When used together with: Qualcomm » Sd212 » Version: N/A
Qualcomm » Sd205 Firmware » Version: N/A
cpe:2.3:o:qualcomm:sd205_firmware:-:*:*:*:*:*:*:*
Matching versions
When used together with: Qualcomm » Sd205 » Version: N/A
Qualcomm » Sd425 Firmware » Version: N/A
cpe:2.3:o:qualcomm:sd425_firmware:-:*:*:*:*:*:*:*
Matching versions
When used together with: Qualcomm » Sd425 » Version: N/A
Qualcomm » Sd427 Firmware » Version: N/A
cpe:2.3:o:qualcomm:sd427_firmware:-:*:*:*:*:*:*:*
Matching versions
When used together with: Qualcomm » Sd427 » Version: N/A
Qualcomm » Sd430 Firmware » Version: N/A
cpe:2.3:o:qualcomm:sd430_firmware:-:*:*:*:*:*:*:*
Matching versions
When used together with: Qualcomm » Sd430 » Version: N/A
Qualcomm » Sd435 Firmware » Version: N/A
cpe:2.3:o:qualcomm:sd435_firmware:-:*:*:*:*:*:*:*
Matching versions
When used together with: Qualcomm » Sd435 » Version: N/A
Qualcomm » Sd450 Firmware » Version: N/A
cpe:2.3:o:qualcomm:sd450_firmware:-:*:*:*:*:*:*:*
Matching versions
When used together with: Qualcomm » Sd450 » Version: N/A
Qualcomm » Sd625 Firmware » Version: N/A
cpe:2.3:o:qualcomm:sd625_firmware:-:*:*:*:*:*:*:*
Matching versions
When used together with: Qualcomm » Sd625 » Version: N/A
Qualcomm » Sd650 Firmware » Version: N/A
cpe:2.3:o:qualcomm:sd650_firmware:-:*:*:*:*:*:*:*
Matching versions
When used together with: Qualcomm » Sd650 » Version: N/A
Qualcomm » Sd652 Firmware » Version: N/A
cpe:2.3:o:qualcomm:sd652_firmware:-:*:*:*:*:*:*:*
Matching versions
When used together with: Qualcomm » Sd652 » Version: N/A
Qualcomm » Sd820a Firmware » Version: N/A
cpe:2.3:o:qualcomm:sd820a_firmware:-:*:*:*:*:*:*:*
Matching versions
When used together with: Qualcomm » Sd820a » Version: N/A
Qualcomm » Sdm429 Firmware » Version: N/A
cpe:2.3:o:qualcomm:sdm429_firmware:-:*:*:*:*:*:*:*
Matching versions
When used together with: Qualcomm » Sdm429 » Version: N/A
Qualcomm » Sdm439 Firmware » Version: N/A
cpe:2.3:o:qualcomm:sdm439_firmware:-:*:*:*:*:*:*:*
Matching versions
When used together with: Qualcomm » Sdm439 » Version: N/A
Qualcomm » Sd845 Firmware » Version: N/A
cpe:2.3:o:qualcomm:sd845_firmware:-:*:*:*:*:*:*:*
Matching versions
When used together with: Qualcomm » Sd845 » Version: N/A

Exploit prediction scoring system (EPSS) score for CVE-2018-11290

EPSS FAQ

0.16%

Probability of exploitation activity in the next 30 days EPSS Score History

~ 38 %

Percentile, the proportion of vulnerabilities that are scored at or less

CVSS scores for CVE-2018-11290

Base Score	Base Severity	CVSS Vector	Exploitability Score	Impact Score	Score Source
5.0	MEDIUM	AV:N/AC:L/Au:N/C:N/I:P/A:N	10.0	2.9	NIST
Access Vector: Network Access Complexity: Low Authentication: None Confidentiality Impact: None Integrity Impact: Partial Availability Impact: None
7.5	HIGH	CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N	3.9	3.6	NIST
Attack Vector: Network Attack Complexity: Low Privileges Required: None User Interaction: None Scope: Unchanged Confidentiality: None Integrity: High Availability: None

CWE ids for CVE-2018-11290

CWE-338 Use of Cryptographically Weak Pseudo-Random Number Generator (PRNG)

The product uses a Pseudo-Random Number Generator (PRNG) in a security context, but the PRNG's algorithm is not cryptographically strong.

Assigned by: nvd@nist.gov (Primary)

References for CVE-2018-11290

http://support.blackberry.com/kb/articleDetail?language=en_US&articleNumber=000051618

BlackBerry Powered by Android Security Bulletin - September 2018
Not Applicable;Third Party Advisory

CVEs referencing this url
https://source.android.com/security/bulletin/2018-09-01#qualcomm-closed-source-components

Android Security Bulletin—September 2018 | Android Open Source Project
Vendor Advisory

CVEs referencing this url
https://www.qualcomm.com/company/product-security/bulletins

Security Advisories | Product Security | Qualcomm
Vendor Advisory

CVEs referencing this url

Jump to

Vulnerability Details : CVE-2018-11290

Products affected by CVE-2018-11290

Exploit prediction scoring system (EPSS) score for CVE-2018-11290

CVSS scores for CVE-2018-11290

CWE ids for CVE-2018-11290

References for CVE-2018-11290