CVE-2020-11209 : Improper authorization in DSP process could allow unauthorized users to downgrad

Improper authorization in DSP process could allow unauthorized users to downgrade the library versions in SD820, SD821, SD820, QCS603, QCS605, SDA855, SA6155P, SA6145P, SA6155, SA6155P, SD855, SD 675, SD660, SD429, SD439

Published 2020-11-12 10:15:13

Updated 2021-12-22 20:39:32

Source Qualcomm, Inc.

View at NVD, CVE.org

Products affected by CVE-2020-11209

Qualcomm » Sd820 Firmware » Version: N/A
cpe:2.3:o:qualcomm:sd820_firmware:-:*:*:*:*:*:*:*
Matching versions
When used together with: Qualcomm » Sd820 » Version: N/A
Qualcomm » Qcs605 Firmware » Version: N/A
cpe:2.3:o:qualcomm:qcs605_firmware:-:*:*:*:*:*:*:*
Matching versions
When used together with: Qualcomm » Qcs605 » Version: N/A
Qualcomm » Sd 675 Firmware » Version: N/A
cpe:2.3:o:qualcomm:sd_675_firmware:-:*:*:*:*:*:*:*
Matching versions
When used together with: Qualcomm » Sd 675 » Version: N/A
Qualcomm » Sd855 Firmware » Version: N/A
cpe:2.3:o:qualcomm:sd855_firmware:-:*:*:*:*:*:*:*
Matching versions
When used together with: Qualcomm » Sd855 » Version: N/A
Qualcomm » Sa6155p Firmware » Version: N/A
cpe:2.3:o:qualcomm:sa6155p_firmware:-:*:*:*:*:*:*:*
Matching versions
When used together with: Qualcomm » Sa6155p » Version: N/A
Qualcomm » Qcs603 Firmware » Version: N/A
cpe:2.3:o:qualcomm:qcs603_firmware:-:*:*:*:*:*:*:*
Matching versions
When used together with: Qualcomm » Qcs603 » Version: N/A
Qualcomm » Sa6155 Firmware » Version: N/A
cpe:2.3:o:qualcomm:sa6155_firmware:-:*:*:*:*:*:*:*
Matching versions
When used together with: Qualcomm » Sa6155 » Version: N/A
Qualcomm » Sda855 Firmware » Version: N/A
cpe:2.3:o:qualcomm:sda855_firmware:-:*:*:*:*:*:*:*
Matching versions
When used together with: Qualcomm » Sda855 » Version: N/A
Qualcomm » Sa6145p Firmware » Version: N/A
cpe:2.3:o:qualcomm:sa6145p_firmware:-:*:*:*:*:*:*:*
Matching versions
When used together with: Qualcomm » Sa6145p » Version: N/A
Qualcomm » Sd660 Firmware » Version: N/A
cpe:2.3:o:qualcomm:sd660_firmware:-:*:*:*:*:*:*:*
Matching versions
When used together with: Qualcomm » Sd660 » Version: N/A
Qualcomm » Sd821 Firmware » Version: N/A
cpe:2.3:o:qualcomm:sd821_firmware:-:*:*:*:*:*:*:*
Matching versions
When used together with: Qualcomm » Sd821 » Version: N/A
Qualcomm » Sd429 Firmware » Version: N/A
cpe:2.3:o:qualcomm:sd429_firmware:-:*:*:*:*:*:*:*
Matching versions
When used together with: Qualcomm » Sd429 » Version: N/A
Qualcomm » Sd439 Firmware » Version: N/A
cpe:2.3:o:qualcomm:sd439_firmware:-:*:*:*:*:*:*:*
Matching versions
When used together with: Qualcomm » Sd439 » Version: N/A

Exploit prediction scoring system (EPSS) score for CVE-2020-11209

EPSS FAQ

0.06%

Probability of exploitation activity in the next 30 days EPSS Score History

~ 22 %

Percentile, the proportion of vulnerabilities that are scored at or less

CVSS scores for CVE-2020-11209

Base Score	Base Severity	CVSS Vector	Exploitability Score	Impact Score	Score Source
2.1	LOW	AV:L/AC:L/Au:N/C:N/I:P/A:N	3.9	2.9	NIST
Access Vector: Local Access Complexity: Low Authentication: None Confidentiality Impact: None Integrity Impact: Partial Availability Impact: None
5.5	MEDIUM	CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N	1.8	3.6	NIST
Attack Vector: Local Attack Complexity: Low Privileges Required: Low User Interaction: None Scope: Unchanged Confidentiality: None Integrity: High Availability: None

CWE ids for CVE-2020-11209

CWE-863 Incorrect Authorization

The product performs an authorization check when an actor attempts to access a resource or perform an action, but it does not correctly perform the check. This allows attackers to bypass intended access restrictions.

Assigned by: nvd@nist.gov (Primary)

References for CVE-2020-11209

https://www.qualcomm.com/company/product-security/bulletins/november-2020-bulletin

Page not found
Broken Link;Vendor Advisory

CVEs referencing this url
https://research.checkpoint.com/2021/pwn2own-qualcomm-dsp/

Pwn2Own Qualcomm DSP - Check Point Research
Exploit;Third Party Advisory

CVEs referencing this url
https://blog.checkpoint.com/2020/08/06/achilles-small-chip-big-peril/

Achilles: Small chip, big peril. - Check Point Software
Third Party Advisory

CVEs referencing this url

Jump to

Vulnerability Details : CVE-2020-11209

Products affected by CVE-2020-11209

Exploit prediction scoring system (EPSS) score for CVE-2020-11209

CVSS scores for CVE-2020-11209

CWE ids for CVE-2020-11209

References for CVE-2020-11209