Qcn6112 Firmware (Qualcomm) - vulnerabilities (CVEs)

130 CVEs, 0 in the last 30 days, 1 known versions, newest CVE from 2026-07-06. Vendor: Qualcomm.

CVEs of Qcn6112 Firmware

• CVE-2026-25268 - CVSS 8.8 (high), 2026-07-06: Memory Corruption when processing invalid HT40 channel layouts during dynamic channel switching operations.
• CVE-2025-59609 - CVSS 5.5 (medium), 2026-06-01: Information Disclosure when processing advertisement frames with malformed MBSSID elements of insufficient length.
• CVE-2025-47339 - CVSS 7.8 (high), 2026-01-07: Memory corruption while deinitializing a HDCP session.
• CVE-2025-47331 - CVSS 6.1 (medium), 2026-01-07: Information disclosure while processing a firmware event.
• CVE-2025-27074 - CVSS 8.8 (high), 2025-11-04: Memory corruption while processing a GP command response.
• CVE-2025-27060 - CVSS 8.8 (high), 2025-10-09: Memory corruption while performing SCM call with malformed inputs.
• CVE-2025-27059 - CVSS 8.8 (high), 2025-10-09: Memory corruption while performing SCM call.
• CVE-2025-27040 - CVSS 6.5 (medium), 2025-10-09: Information disclosure may occur while processing the hypervisor log.
• CVE-2025-47318 - CVSS 7.5 (high), 2025-09-24: Transient DOS while parsing the EPTM test control message to get the test pattern.
• CVE-2025-47326 - CVSS 7.5 (high), 2025-09-24: Transient DOS while handling command data during power control processing.
• CVE-2025-27066 - CVSS 7.5 (high), 2025-08-06: Transient DOS while processing an ANQP message.
• CVE-2025-27061 - CVSS 7.8 (high), 2025-07-08: Memory corruption whhile handling the subsystem failure memory during the parsing of video packets received from the video firmware.
• CVE-2025-27057 - CVSS 7.5 (high), 2025-07-08: Transient DOS while handling beacon frames with invalid IE header length.
• CVE-2025-27042 - CVSS 7.8 (high), 2025-07-08: Memory corruption while processing video packets received from video firmware.
• CVE-2025-21446 - CVSS 7.5 (high), 2025-07-08: Transient DOS may occur when processing vendor-specific information elements while parsing a WLAN frame for BTM requests.
• CVE-2025-21463 - CVSS 7.5 (high), 2025-06-03: Transient DOS while processing the EHT operation IE in the received beacon frame.
• CVE-2025-21448 - CVSS 7.5 (high), 2025-04-07: Transient DOS may occur while parsing SSID in action frames.
• CVE-2025-21435 - CVSS 7.5 (high), 2025-04-07: Transient DOS may occur while parsing extended IE in beacon.
• CVE-2024-43057 - CVSS 7.8 (high), 2025-03-03: Memory corruption while processing command in Glink linux.
• CVE-2024-49839 - CVSS 9.8 (critical), 2025-02-03: Memory corruption during management frame processing due to mismatch in T2LM info element.
• CVE-2024-45569 - CVSS 9.8 (critical), 2025-02-03: Memory corruption while parsing the ML IE due to invalid frame content.
• CVE-2024-45571 - CVSS 7.8 (high), 2025-02-03: Memory corruption may occour occur when stopping the WLAN interface after processing a WMI command from the interface.
• CVE-2024-45558 - CVSS 7.5 (high), 2025-01-06: Transient DOS can occur when the driver parses the per STA profile IE and tries to access the EXTN element ID without checking the IE length.
• CVE-2024-38408 - CVSS 9.1 (critical), 2024-11-04: Cryptographic issue when a controller receives an LMP start encryption command under unexpected conditions.
• CVE-2024-33073 - CVSS 8.2 (high), 2024-10-07: Information disclosure while parsing the BSS parameter change count or MLD capabilities fields of the ML IE.
• CVE-2024-33066 - CVSS 9.8 (critical), 2024-10-07: Memory corruption while redirecting log file to any file location with any file name.
• CVE-2024-33049 - CVSS 7.5 (high), 2024-10-07: Transient DOS while parsing noninheritance IE of Extension element when length of IE is 2 of beacon frame.
• CVE-2024-33057 - CVSS 7.5 (high), 2024-09-02: Transient DOS while parsing the multi-link element Control field when common information length check is missing before updating the location.
• CVE-2024-33050 - CVSS 7.5 (high), 2024-09-02: Transient DOS while parsing MBSSID during new IE generation in beacon/probe frame when IE length check is either missing or improper.
• CVE-2024-33048 - CVSS 7.5 (high), 2024-09-02: Transient DOS while parsing the received TID-to-link mapping element of beacon/probe response frame.
• CVE-2024-33025 - CVSS 7.5 (high), 2024-08-05: Transient DOS while parsing the BSS parameter change count or MLD capabilities fields of the ML IE.
• CVE-2024-33024 - CVSS 7.5 (high), 2024-08-05: Transient DOS while parsing the ML IE when a beacon with length field inside the common info of ML IE greater than the ML IE length.
• CVE-2024-33026 - CVSS 7.5 (high), 2024-08-05: Transient DOS while parsing probe response and assoc response frame when received frame length is less than max size of timestamp.
• CVE-2024-33018 - CVSS 7.5 (high), 2024-08-05: Transient DOS while parsing the received TID-to-link mapping element of the TID-to-link mapping action frame.
• CVE-2024-33015 - CVSS 7.5 (high), 2024-08-05: Transient DOS while parsing SCAN RNR IE when bytes received from AP is such that the size of the last param of IE is less than neighbor report.
• CVE-2024-33019 - CVSS 7.5 (high), 2024-08-05: Transient DOS while parsing the received TID-to-link mapping action frame.
• CVE-2024-33013 - CVSS 7.5 (high), 2024-08-05: Transient DOS when driver accesses the ML IE memory and offset value is incremented beyond ML IE length.
• CVE-2024-33012 - CVSS 7.5 (high), 2024-08-05: Transient DOS while parsing the multiple MBSSID IEs from the beacon, when the tag length is non-zero value but with end of beacon.
• CVE-2024-33014 - CVSS 7.5 (high), 2024-08-05: Transient DOS while parsing ESP IE from beacon/probe response frame.
• CVE-2024-33011 - CVSS 7.5 (high), 2024-08-05: Transient DOS while parsing the MBSSID IE from the beacons, when the MBSSID IE length is zero.
• CVE-2024-33010 - CVSS 7.5 (high), 2024-08-05: Transient DOS while parsing fragments of MBSSID IE from beacon frame.
• CVE-2024-21467 - CVSS 7.5 (high), 2024-08-05: Information disclosure while handling beacon probe frame during scan entry generation in client side.
• CVE-2024-21459 - CVSS 7.5 (high), 2024-08-05: Information disclosure while handling beacon or probe response frame in STA.
• CVE-2024-21482 - CVSS 7.8 (high), 2024-07-01: Memory corruption during the secure boot process, when the `bootm` command is used, it bypasses the authentication of the kernel/rootfs image.
• CVE-2024-23368 - CVSS 7.8 (high), 2024-07-01: Memory corruption when allocating and accessing an entry in an SMEM partition.
• CVE-2024-21458 - CVSS 7.5 (high), 2024-07-01: Information disclosure while handling SA query action frame.
• CVE-2024-21457 - CVSS 7.5 (high), 2024-07-01: INformation disclosure while handling Multi-link IE in beacon frame.
• CVE-2024-23363 - CVSS 7.5 (high), 2024-06-03: Transient DOS while processing an improperly formatted Fine Time Measurement (FTM) management frame.
• CVE-2023-43537 - CVSS 7.5 (high), 2024-06-03: Information disclosure while handling T2LM Action Frame in WLAN Host.
• CVE-2024-21477 - CVSS 7.5 (high), 2024-05-06: Transient DOS while parsing a protected 802.11az Fine Time Measurement (FTM) frame.
• CVE-2024-21473 - CVSS 9.8 (critical), 2024-04-01: Memory corruption while redirecting log file to any file location with any file name.
• CVE-2023-43553 - CVSS 9.8 (critical), 2024-03-04: Memory corruption while parsing beacon/probe response frame when AP sends more supported links in MLIE.
• CVE-2023-43552 - CVSS 9.8 (critical), 2024-03-04: Memory corruption while processing MBSSID beacon containing several subelement IE.
• CVE-2023-43549 - CVSS 8.4 (high), 2024-03-04: Memory corruption while processing TPC target power table in FTM TPC.
• CVE-2023-43539 - CVSS 7.5 (high), 2024-03-04: Transient DOS while processing an improperly formatted 802.11az Fine Time Measurement protocol frame.
• CVE-2023-33105 - CVSS 7.5 (high), 2024-03-04: Transient DOS in WLAN Host and Firmware when large number of open authentication frames are sent with an invalid transaction sequence number.
• CVE-2023-28578 - CVSS 9.3 (critical), 2024-03-04: Memory corruption in Core Services while executing the command for removing a single event listener.
• CVE-2023-43536 - CVSS 7.5 (high), 2024-02-06: Transient DOS while parse fils IE with length equal to 1.
• CVE-2023-43522 - CVSS 7.5 (high), 2024-02-06: Transient DOS while key unwrapping process, when the given encrypted key is empty or NULL.
• CVE-2023-43511 - CVSS 7.5 (high), 2024-01-02: Transient DOS while parsing IPv6 extension header when WLAN firmware receives an IPv6 packet that contains `IPPROTO_NONE` as the next header.
• CVE-2023-33116 - CVSS 7.5 (high), 2024-01-02: Transient DOS while parsing ieee80211_parse_mscs_ie in WIN WLAN driver.
• CVE-2023-33109 - CVSS 7.5 (high), 2024-01-02: Transient DOS while processing a WMI P2P listen start command (0xD00A) sent from host.
• CVE-2023-33062 - CVSS 7.5 (high), 2024-01-02: Transient DOS in WLAN Firmware while parsing a BTM request.
• CVE-2023-33098 - CVSS 7.5 (high), 2023-12-05: Transient DOS while parsing WPA IES, when it is passed with length more than expected size.
• CVE-2023-33097 - CVSS 7.5 (high), 2023-12-05: Transient DOS in WLAN Firmware while processing a FTMR frame.
• CVE-2023-33088 - CVSS 8.4 (high), 2023-12-05: Memory corruption when processing cmd parameters while parsing vdev.
• CVE-2023-33083 - CVSS 9.8 (critical), 2023-12-05: Memory corruption in WLAN Host while processing RRM beacon on the AP.
• CVE-2023-33082 - CVSS 9.8 (critical), 2023-12-05: Memory corruption while sending an Assoc Request having BTM Query or BTM Response containing MBO IE.
• CVE-2023-33089 - CVSS 7.5 (high), 2023-12-05: Transient DOS when processing a NULL buffer while parsing WLAN vdev.
• CVE-2023-33081 - CVSS 7.5 (high), 2023-12-05: Transient DOS while converting TWT (Target Wake Time) frame parameters in the OTA broadcast.
• CVE-2023-33080 - CVSS 7.5 (high), 2023-12-05: Transient DOS while parsing a vender specific IE (Information Element) of reassociation response management frame.
• CVE-2023-33053 - CVSS 8.4 (high), 2023-12-05: Memory corruption in Kernel while parsing metadata.
• CVE-2023-33041 - CVSS 7.5 (high), 2023-12-05: Under certain scenarios the WLAN Firmware will reach an assertion due to state confusion while looking up peer ids.
• CVE-2023-33061 - CVSS 7.5 (high), 2023-11-07: Transient DOS in WLAN Firmware while parsing WLAN beacon or probe-response frame.
• CVE-2023-33056 - CVSS 7.5 (high), 2023-11-07: Transient DOS in WLAN Firmware when firmware receives beacon including T2LM IE.
• CVE-2023-33048 - CVSS 7.5 (high), 2023-11-07: Transient DOS in WLAN Firmware while parsing t2lm buffers.
• CVE-2023-33047 - CVSS 7.5 (high), 2023-11-07: Transient DOS in WLAN Firmware while parsing no-inherit IES.
• CVE-2023-33045 - CVSS 9.8 (critical), 2023-11-07: Memory corruption in WLAN Firmware while parsing a NAN management frame carrying a S3 attribute.
• CVE-2023-28553 - CVSS 6.1 (medium), 2023-11-07: Information Disclosure in WLAN Host when processing WMI event command.
• CVE-2023-33028 - CVSS 9.8 (critical), 2023-10-03: Memory corruption in WLAN Firmware while doing a memory copy of pmk cache.
• CVE-2023-33027 - CVSS 7.5 (high), 2023-10-03: Transient DOS in WLAN Firmware while parsing rsn ies.
• CVE-2023-33026 - CVSS 7.5 (high), 2023-10-03: Transient DOS in WLAN Firmware while parsing a NAN management frame.
• CVE-2023-28539 - CVSS 7.8 (high), 2023-10-03: Memory corruption in WLAN Host when the firmware invokes multiple WMI Service Available command.
• CVE-2023-28573 - CVSS 7.8 (high), 2023-09-05: Memory corruption in WLAN HAL while parsing WMI command parameters.
• CVE-2023-28567 - CVSS 7.8 (high), 2023-09-05: Memory corruption in WLAN HAL while handling command through WMI interfaces.
• CVE-2023-28557 - CVSS 7.8 (high), 2023-09-05: Memory corruption in WLAN HAL while processing command parameters from untrusted WMI payload.
• CVE-2023-28549 - CVSS 7.8 (high), 2023-09-05: Memory corruption in WLAN HAL while parsing Rx buffer in processing TLV payload.
• CVE-2023-28548 - CVSS 7.8 (high), 2023-09-05: Memory corruption in WLAN HAL while processing Tx/Rx commands from QDART.
• CVE-2022-33275 - CVSS 8.4 (high), 2023-09-05: Memory corruption due to improper validation of array index in WLAN HAL when received lm_itemNum is out of range.
• CVE-2023-22386 - CVSS 7.8 (high), 2023-07-04: Memory Corruption in WLAN HOST while processing WLAN FW request to allocate memory.
• CVE-2023-21658 - CVSS 7.5 (high), 2023-06-06: Transient DOS in WLAN Firmware while processing the received beacon or probe response frame.
• CVE-2023-21661 - CVSS 7.5 (high), 2023-06-06: Transient DOS while parsing WLAN beacon or probe-response frame.
• CVE-2023-21659 - CVSS 7.5 (high), 2023-06-06: Transient DOS in WLAN Firmware while processing frames with missing header fields.
• CVE-2022-22076 - CVSS 7.1 (high), 2023-06-06: information disclosure due to cryptographic issue in Core during RPMB read request.
• CVE-2022-40532 - CVSS 8.4 (high), 2023-04-13: Memory corruption due to integer overflow or wraparound in WLAN while sending WMI cmd from host to target.
• CVE-2022-40531 - CVSS 8.4 (high), 2023-03-10: Memory corruption in WLAN due to incorrect type cast while sending WMI_SCAN_SCH_PRIO_TBL_CMDID message.
• CVE-2022-40530 - CVSS 8.4 (high), 2023-03-10: Memory corruption in WLAN due to integer overflow to buffer overflow in WLAN during initialization phase.
• CVE-2022-40527 - CVSS 7.5 (high), 2023-03-10: Transient DOS due to reachable assertion in WLAN while processing PEER ID populated by TQM.
• CVE-2022-40514 - CVSS 9.8 (critical), 2023-02-12: Memory corruption due to buffer copy without checking the size of input in WLAN Firmware while processing CCKM IE in reassoc response frame.
• CVE-2022-40512 - CVSS 7.5 (high), 2023-02-12: Transient DOS in WLAN Firmware due to buffer over-read while processing probe response or beacon.