CVE-2019-14026 : Possible buffer overflow in WLAN WMI handler due to lack of ssid length check when copying data in Snapdragon Auto, Snap

Possible buffer overflow in WLAN WMI handler due to lack of ssid length check when copying data in Snapdragon Auto, Snapdragon Compute, Snapdragon Connectivity, Snapdragon Consumer Electronics Connectivity, Snapdragon Consumer IOT, Snapdragon Industrial IOT, Snapdragon Mobile, Snapdragon Voice & Music, Snapdragon Wired Infrastructure and Networking in APQ8009, APQ8017, APQ8053, APQ8096, APQ8096AU, APQ8098, IPQ6018, IPQ8074, MDM9206, MDM9207C, MDM9607, MDM9640, MDM9650, MSM8996AU, MSM8998, Nicobar, QCA6174A, QCA6574, QCA6574AU, QCA6584AU, QCA8081, QCA9377, QCA9379, QCA9886, QCN7605, QCS404, QCS405, QCS605, Rennell, SA6155P, SC8180X, SDA660, SDA845, SDM630, SDM636, SDM660, SDM670, SDM710, SDM845, SDM850, SDX20, SDX24, SM6150, SM7150, SM8150, SM8250, SXR1130, SXR2130

Published 2020-03-05 09:15:17

Updated 2020-03-09 12:46:48

Source Qualcomm, Inc.

View at NVD, CVE.org

Vulnerability category: Overflow

Exploit prediction scoring system (EPSS) score for CVE-2019-14026

EPSS FAQ

0.04%

Probability of exploitation activity in the next 30 days EPSS Score History

~ 10 %

Percentile, the proportion of vulnerabilities that are scored at or less

CVSS scores for CVE-2019-14026

Base Score	Base Severity	CVSS Vector	Exploitability Score	Impact Score	Score Source
7.2	HIGH	AV:L/AC:L/Au:N/C:C/I:C/A:C	3.9	10.0	NIST
Access Vector: Local Access Complexity: Low Authentication: None Confidentiality Impact: Complete Integrity Impact: Complete Availability Impact: Complete
7.8	HIGH	CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H	1.8	5.9	NIST
Attack Vector: Local Attack Complexity: Low Privileges Required: Low User Interaction: None Scope: Unchanged Confidentiality: High Integrity: High Availability: High

CWE ids for CVE-2019-14026

CWE-120 Buffer Copy without Checking Size of Input ('Classic Buffer Overflow')

The product copies an input buffer to an output buffer without verifying that the size of the input buffer is less than the size of the output buffer, leading to a buffer overflow.

Assigned by: nvd@nist.gov (Primary)

Products affected by CVE-2019-14026

Qualcomm » Mdm9206 Firmware » Version: N/A
cpe:2.3:o:qualcomm:mdm9206_firmware:-:*:*:*:*:*:*:*
Matching versions
When used together with: Qualcomm » Mdm9206 » Version: N/A
Qualcomm » Mdm9607 Firmware » Version: N/A
cpe:2.3:o:qualcomm:mdm9607_firmware:-:*:*:*:*:*:*:*
Matching versions
When used together with: Qualcomm » Mdm9607 » Version: N/A
Qualcomm » Mdm9650 Firmware » Version: N/A
cpe:2.3:o:qualcomm:mdm9650_firmware:-:*:*:*:*:*:*:*
Matching versions
When used together with: Qualcomm » Mdm9650 » Version: N/A
Qualcomm » Mdm9640 Firmware » Version: N/A
cpe:2.3:o:qualcomm:mdm9640_firmware:-:*:*:*:*:*:*:*
Matching versions
When used together with: Qualcomm » Mdm9640 » Version: N/A
Qualcomm » Sdx20 Firmware » Version: N/A
cpe:2.3:o:qualcomm:sdx20_firmware:-:*:*:*:*:*:*:*
Matching versions
When used together with: Qualcomm » Sdx20 » Version: N/A
Qualcomm » Sdm630 Firmware » Version: N/A
cpe:2.3:o:qualcomm:sdm630_firmware:-:*:*:*:*:*:*:*
Matching versions
When used together with: Qualcomm » Sdm630 » Version: N/A
Qualcomm » Sdm636 Firmware » Version: N/A
cpe:2.3:o:qualcomm:sdm636_firmware:-:*:*:*:*:*:*:*
Matching versions
When used together with: Qualcomm » Sdm636 » Version: N/A
Qualcomm » Sdm660 Firmware » Version: N/A
cpe:2.3:o:qualcomm:sdm660_firmware:-:*:*:*:*:*:*:*
Matching versions
When used together with: Qualcomm » Sdm660 » Version: N/A
Qualcomm » Apq8096au Firmware » Version: N/A
cpe:2.3:o:qualcomm:apq8096au_firmware:-:*:*:*:*:*:*:*
Matching versions
When used together with: Qualcomm » Apq8096au » Version: N/A
Qualcomm » Msm8996au Firmware » Version: N/A
cpe:2.3:o:qualcomm:msm8996au_firmware:-:*:*:*:*:*:*:*
Matching versions
When used together with: Qualcomm » Msm8996au » Version: N/A
Qualcomm » Sdm845 Firmware » Version: N/A
cpe:2.3:o:qualcomm:sdm845_firmware:-:*:*:*:*:*:*:*
Matching versions
When used together with: Qualcomm » Sdm845 » Version: N/A
Qualcomm » Qca6174a Firmware » Version: N/A
cpe:2.3:o:qualcomm:qca6174a_firmware:-:*:*:*:*:*:*:*
Matching versions
When used together with: Qualcomm » Qca6174a » Version: N/A
Qualcomm » Qca6574au Firmware » Version: N/A
cpe:2.3:o:qualcomm:qca6574au_firmware:-:*:*:*:*:*:*:*
Matching versions
When used together with: Qualcomm » Qca6574au » Version: N/A
Qualcomm » Qca6584au Firmware » Version: N/A
cpe:2.3:o:qualcomm:qca6584au_firmware:-:*:*:*:*:*:*:*
Matching versions
When used together with: Qualcomm » Qca6584au » Version: N/A
Qualcomm » Qca9377 Firmware » Version: N/A
cpe:2.3:o:qualcomm:qca9377_firmware:-:*:*:*:*:*:*:*
Matching versions
When used together with: Qualcomm » Qca9377 » Version: N/A
Qualcomm » Qca9379 Firmware » Version: N/A
cpe:2.3:o:qualcomm:qca9379_firmware:-:*:*:*:*:*:*:*
Matching versions
When used together with: Qualcomm » Qca9379 » Version: N/A
Qualcomm » Qca9886 Firmware » Version: N/A
cpe:2.3:o:qualcomm:qca9886_firmware:-:*:*:*:*:*:*:*
Matching versions
When used together with: Qualcomm » Qca9886 » Version: N/A
Qualcomm » Qca6574 Firmware » Version: N/A
cpe:2.3:o:qualcomm:qca6574_firmware:-:*:*:*:*:*:*:*
Matching versions
When used together with: Qualcomm » Qca6574 » Version: N/A
Qualcomm » Msm8998 Firmware » Version: N/A
cpe:2.3:o:qualcomm:msm8998_firmware:-:*:*:*:*:*:*:*
Matching versions
When used together with: Qualcomm » Msm8998 » Version: N/A
Qualcomm » Sdm710 Firmware » Version: N/A
cpe:2.3:o:qualcomm:sdm710_firmware:-:*:*:*:*:*:*:*
Matching versions
When used together with: Qualcomm » Sdm710 » Version: N/A
Qualcomm » Sda660 Firmware » Version: N/A
cpe:2.3:o:qualcomm:sda660_firmware:-:*:*:*:*:*:*:*
Matching versions
When used together with: Qualcomm » Sda660 » Version: N/A
Qualcomm » Ipq8074 Firmware » Version: N/A
cpe:2.3:o:qualcomm:ipq8074_firmware:-:*:*:*:*:*:*:*
Matching versions
When used together with: Qualcomm » Ipq8074 » Version: N/A
Qualcomm » Sda845 Firmware » Version: N/A
cpe:2.3:o:qualcomm:sda845_firmware:-:*:*:*:*:*:*:*
Matching versions
When used together with: Qualcomm » Sda845 » Version: N/A
Qualcomm » Sdx24 Firmware » Version: N/A
cpe:2.3:o:qualcomm:sdx24_firmware:-:*:*:*:*:*:*:*
Matching versions
When used together with: Qualcomm » Sdx24 » Version: N/A
Qualcomm » Sxr1130 Firmware » Version: N/A
cpe:2.3:o:qualcomm:sxr1130_firmware:-:*:*:*:*:*:*:*
Matching versions
When used together with: Qualcomm » Sxr1130 » Version: N/A
Qualcomm » Qcs605 Firmware » Version: N/A
cpe:2.3:o:qualcomm:qcs605_firmware:-:*:*:*:*:*:*:*
Matching versions
When used together with: Qualcomm » Qcs605 » Version: N/A
Qualcomm » Sm7150 Firmware » Version: N/A
cpe:2.3:o:qualcomm:sm7150_firmware:-:*:*:*:*:*:*:*
Matching versions
When used together with: Qualcomm » Sm7150 » Version: N/A
Qualcomm » Qca8081 Firmware » Version: N/A
cpe:2.3:o:qualcomm:qca8081_firmware:-:*:*:*:*:*:*:*
Matching versions
When used together with: Qualcomm » Qca8081 » Version: N/A
Qualcomm » Qcs405 Firmware » Version: N/A
cpe:2.3:o:qualcomm:qcs405_firmware:-:*:*:*:*:*:*:*
Matching versions
When used together with: Qualcomm » Qcs405 » Version: N/A
Qualcomm » Qcs404 Firmware » Version: N/A
cpe:2.3:o:qualcomm:qcs404_firmware:-:*:*:*:*:*:*:*
Matching versions
When used together with: Qualcomm » Qcs404 » Version: N/A
Qualcomm » Apq8009 Firmware » Version: N/A
cpe:2.3:o:qualcomm:apq8009_firmware:-:*:*:*:*:*:*:*
Matching versions
When used together with: Qualcomm » Apq8009 » Version: N/A
Qualcomm » Apq8017 Firmware » Version: N/A
cpe:2.3:o:qualcomm:apq8017_firmware:-:*:*:*:*:*:*:*
Matching versions
When used together with: Qualcomm » Apq8017 » Version: N/A
Qualcomm » Apq8053 Firmware » Version: N/A
cpe:2.3:o:qualcomm:apq8053_firmware:-:*:*:*:*:*:*:*
Matching versions
When used together with: Qualcomm » Apq8053 » Version: N/A
Qualcomm » Mdm9207c Firmware » Version: N/A
cpe:2.3:o:qualcomm:mdm9207c_firmware:-:*:*:*:*:*:*:*
Matching versions
When used together with: Qualcomm » Mdm9207c » Version: N/A
Qualcomm » Qcn7605 Firmware » Version: N/A
cpe:2.3:o:qualcomm:qcn7605_firmware:-:*:*:*:*:*:*:*
Matching versions
When used together with: Qualcomm » Qcn7605 » Version: N/A
Qualcomm » Sm6150 Firmware » Version: N/A
cpe:2.3:o:qualcomm:sm6150_firmware:-:*:*:*:*:*:*:*
Matching versions
When used together with: Qualcomm » Sm6150 » Version: N/A
Qualcomm » Sm8150 Firmware » Version: N/A
cpe:2.3:o:qualcomm:sm8150_firmware:-:*:*:*:*:*:*:*
Matching versions
When used together with: Qualcomm » Sm8150 » Version: N/A
Qualcomm » Apq8096 Firmware » Version: N/A
cpe:2.3:o:qualcomm:apq8096_firmware:-:*:*:*:*:*:*:*
Matching versions
When used together with: Qualcomm » Apq8096 » Version: N/A
Qualcomm » Apq8098 Firmware » Version: N/A
cpe:2.3:o:qualcomm:apq8098_firmware:-:*:*:*:*:*:*:*
Matching versions
When used together with: Qualcomm » Apq8098 » Version: N/A
Qualcomm » Nicobar Firmware » Version: N/A
cpe:2.3:o:qualcomm:nicobar_firmware:-:*:*:*:*:*:*:*
Matching versions
When used together with: Qualcomm » Nicobar » Version: N/A
Qualcomm » Sc8180x Firmware » Version: N/A
cpe:2.3:o:qualcomm:sc8180x_firmware:-:*:*:*:*:*:*:*
Matching versions
When used together with: Qualcomm » Sc8180x » Version: N/A
Qualcomm » Sdm670 Firmware » Version: N/A
cpe:2.3:o:qualcomm:sdm670_firmware:-:*:*:*:*:*:*:*
Matching versions
When used together with: Qualcomm » Sdm670 » Version: N/A
Qualcomm » Sdm850 Firmware » Version: N/A
cpe:2.3:o:qualcomm:sdm850_firmware:-:*:*:*:*:*:*:*
Matching versions
When used together with: Qualcomm » Sdm850 » Version: N/A
Qualcomm » Sm8250 Firmware » Version: N/A
cpe:2.3:o:qualcomm:sm8250_firmware:-:*:*:*:*:*:*:*
Matching versions
When used together with: Qualcomm » Sm8250 » Version: N/A
Qualcomm » Sxr2130 Firmware » Version: N/A
cpe:2.3:o:qualcomm:sxr2130_firmware:-:*:*:*:*:*:*:*
Matching versions
When used together with: Qualcomm » Sxr2130 » Version: N/A
Qualcomm » Sa6155p Firmware » Version: N/A
cpe:2.3:o:qualcomm:sa6155p_firmware:-:*:*:*:*:*:*:*
Matching versions
When used together with: Qualcomm » Sa6155p » Version: N/A
Qualcomm » Rennell Firmware » Version: N/A
cpe:2.3:o:qualcomm:rennell_firmware:-:*:*:*:*:*:*:*
Matching versions
When used together with: Qualcomm » Rennell » Version: N/A
Qualcomm » Ipq6018 Firmware » Version: N/A
cpe:2.3:o:qualcomm:ipq6018_firmware:-:*:*:*:*:*:*:*
Matching versions
When used together with: Qualcomm » Ipq6018 » Version: N/A

Vulnerability Details : CVE-2019-14026

Exploit prediction scoring system (EPSS) score for CVE-2019-14026

CVSS scores for CVE-2019-14026

CWE ids for CVE-2019-14026

References for CVE-2019-14026

Products affected by CVE-2019-14026