Qcn9070 Firmware (Qualcomm) - vulnerabilities (CVEs)

242 CVEs, 0 in the last 30 days, 1 known versions, newest CVE from 2026-09-17. Vendor: Qualcomm.

CVEs of Qcn9070 Firmware

• CVE-2026-25275 - CVSS 7.5 (high), 2026-09-17: Transient DOS when processing authentication frames with invalid FILS information element header lengths.
• CVE-2026-25268 - CVSS 8.8 (high), 2026-07-06: Memory Corruption when processing invalid HT40 channel layouts during dynamic channel switching operations.
• CVE-2026-24088 - CVSS 8.2 (high), 2026-06-01: Cryptographic Issue while processing a specific partition which allows unauthorized write access to load a customized bootloader.
• CVE-2025-59609 - CVSS 5.5 (medium), 2026-06-01: Information Disclosure when processing advertisement frames with malformed MBSSID elements of insufficient length.
• CVE-2025-47403 - CVSS 7.5 (high), 2026-05-04: Transient DOS when processing a malformed Fast Transition response frame with an invalid header structure during wireless roaming.
• CVE-2026-21367 - CVSS 7.6 (high), 2026-04-06: Transient DOS when processing nonstandard FILS Discovery Frames with out-of-range action sizes during initial scans.
• CVE-2025-47339 - CVSS 7.8 (high), 2026-01-07: Memory corruption while deinitializing a HDCP session.
• CVE-2025-47331 - CVSS 6.1 (medium), 2026-01-07: Information disclosure while processing a firmware event.
• CVE-2025-47325 - CVSS 6.5 (medium), 2025-12-18: Information disclosure while processing system calls with invalid parameters.
• CVE-2025-27074 - CVSS 8.8 (high), 2025-11-04: Memory corruption while processing a GP command response.
• CVE-2025-27059 - CVSS 8.8 (high), 2025-10-09: Memory corruption while performing SCM call.
• CVE-2025-27060 - CVSS 8.8 (high), 2025-10-09: Memory corruption while performing SCM call with malformed inputs.
• CVE-2025-27040 - CVSS 6.5 (medium), 2025-10-09: Information disclosure may occur while processing the hypervisor log.
• CVE-2025-47318 - CVSS 7.5 (high), 2025-09-24: Transient DOS while parsing the EPTM test control message to get the test pattern.
• CVE-2025-47326 - CVSS 7.5 (high), 2025-09-24: Transient DOS while handling command data during power control processing.
• CVE-2025-27073 - CVSS 7.5 (high), 2025-08-06: Transient DOS while creating NDP instance.
• CVE-2025-27066 - CVSS 7.5 (high), 2025-08-06: Transient DOS while processing an ANQP message.
• CVE-2025-21465 - CVSS 6.5 (medium), 2025-08-06: Information disclosure while processing the hash segment in an MBN file.
• CVE-2025-21464 - CVSS 6.5 (medium), 2025-08-06: Information disclosure while reading data from an image using specified offset and size parameters.
• CVE-2025-27061 - CVSS 7.8 (high), 2025-07-08: Memory corruption whhile handling the subsystem failure memory during the parsing of video packets received from the video firmware.
• CVE-2025-27057 - CVSS 7.5 (high), 2025-07-08: Transient DOS while handling beacon frames with invalid IE header length.
• CVE-2025-27043 - CVSS 7.8 (high), 2025-07-08: Memory corruption while processing manipulated payload in video firmware.
• CVE-2025-27042 - CVSS 7.8 (high), 2025-07-08: Memory corruption while processing video packets received from video firmware.
• CVE-2025-21446 - CVSS 7.5 (high), 2025-07-08: Transient DOS may occur when processing vendor-specific information elements while parsing a WLAN frame for BTM requests.
• CVE-2025-21463 - CVSS 7.5 (high), 2025-06-03: Transient DOS while processing the EHT operation IE in the received beacon frame.
• CVE-2025-21448 - CVSS 7.5 (high), 2025-04-07: Transient DOS may occur while parsing SSID in action frames.
• CVE-2025-21435 - CVSS 7.5 (high), 2025-04-07: Transient DOS may occur while parsing extended IE in beacon.
• CVE-2024-43046 - CVSS 5.5 (medium), 2025-04-07: There may be information disclosure during memory re-allocation in TZ Secure OS.
• CVE-2024-43057 - CVSS 7.8 (high), 2025-03-03: Memory corruption while processing command in Glink linux.
• CVE-2024-49839 - CVSS 9.8 (critical), 2025-02-03: Memory corruption during management frame processing due to mismatch in T2LM info element.
• CVE-2024-45571 - CVSS 7.8 (high), 2025-02-03: Memory corruption may occour occur when stopping the WLAN interface after processing a WMI command from the interface.
• CVE-2024-45569 - CVSS 9.8 (critical), 2025-02-03: Memory corruption while parsing the ML IE due to invalid frame content.
• CVE-2024-45558 - CVSS 7.5 (high), 2025-01-06: Transient DOS can occur when the driver parses the per STA profile IE and tries to access the EXTN element ID without checking the IE length.
• CVE-2024-38408 - CVSS 9.1 (critical), 2024-11-04: Cryptographic issue when a controller receives an LMP start encryption command under unexpected conditions.
• CVE-2024-33073 - CVSS 8.2 (high), 2024-10-07: Information disclosure while parsing the BSS parameter change count or MLD capabilities fields of the ML IE.
• CVE-2024-33049 - CVSS 7.5 (high), 2024-10-07: Transient DOS while parsing noninheritance IE of Extension element when length of IE is 2 of beacon frame.
• CVE-2024-33066 - CVSS 9.8 (critical), 2024-10-07: Memory corruption while redirecting log file to any file location with any file name.
• CVE-2024-33057 - CVSS 7.5 (high), 2024-09-02: Transient DOS while parsing the multi-link element Control field when common information length check is missing before updating the location.
• CVE-2024-33048 - CVSS 7.5 (high), 2024-09-02: Transient DOS while parsing the received TID-to-link mapping element of beacon/probe response frame.
• CVE-2024-33050 - CVSS 7.5 (high), 2024-09-02: Transient DOS while parsing MBSSID during new IE generation in beacon/probe frame when IE length check is either missing or improper.
• CVE-2024-33016 - CVSS 6.8 (medium), 2024-09-02: memory corruption when an invalid firehose patch command is invoked.
• CVE-2024-33024 - CVSS 7.5 (high), 2024-08-05: Transient DOS while parsing the ML IE when a beacon with length field inside the common info of ML IE greater than the ML IE length.
• CVE-2024-33026 - CVSS 7.5 (high), 2024-08-05: Transient DOS while parsing probe response and assoc response frame when received frame length is less than max size of timestamp.
• CVE-2024-33025 - CVSS 7.5 (high), 2024-08-05: Transient DOS while parsing the BSS parameter change count or MLD capabilities fields of the ML IE.
• CVE-2024-33015 - CVSS 7.5 (high), 2024-08-05: Transient DOS while parsing SCAN RNR IE when bytes received from AP is such that the size of the last param of IE is less than neighbor report.
• CVE-2024-33019 - CVSS 7.5 (high), 2024-08-05: Transient DOS while parsing the received TID-to-link mapping action frame.
• CVE-2024-33018 - CVSS 7.5 (high), 2024-08-05: Transient DOS while parsing the received TID-to-link mapping element of the TID-to-link mapping action frame.
• CVE-2024-33012 - CVSS 7.5 (high), 2024-08-05: Transient DOS while parsing the multiple MBSSID IEs from the beacon, when the tag length is non-zero value but with end of beacon.
• CVE-2024-33014 - CVSS 7.5 (high), 2024-08-05: Transient DOS while parsing ESP IE from beacon/probe response frame.
• CVE-2024-33013 - CVSS 7.5 (high), 2024-08-05: Transient DOS when driver accesses the ML IE memory and offset value is incremented beyond ML IE length.
• CVE-2024-33011 - CVSS 7.5 (high), 2024-08-05: Transient DOS while parsing the MBSSID IE from the beacons, when the MBSSID IE length is zero.
• CVE-2024-33010 - CVSS 7.5 (high), 2024-08-05: Transient DOS while parsing fragments of MBSSID IE from beacon frame.
• CVE-2024-21467 - CVSS 7.5 (high), 2024-08-05: Information disclosure while handling beacon probe frame during scan entry generation in client side.
• CVE-2024-21459 - CVSS 7.5 (high), 2024-08-05: Information disclosure while handling beacon or probe response frame in STA.
• CVE-2024-21482 - CVSS 7.8 (high), 2024-07-01: Memory corruption during the secure boot process, when the `bootm` command is used, it bypasses the authentication of the kernel/rootfs image.
• CVE-2024-23368 - CVSS 7.8 (high), 2024-07-01: Memory corruption when allocating and accessing an entry in an SMEM partition.
• CVE-2024-21462 - CVSS 7.1 (high), 2024-07-01: Transient DOS while loading the TA ELF file.
• CVE-2024-21458 - CVSS 7.5 (high), 2024-07-01: Information disclosure while handling SA query action frame.
• CVE-2024-21457 - CVSS 7.5 (high), 2024-07-01: INformation disclosure while handling Multi-link IE in beacon frame.
• CVE-2024-23363 - CVSS 7.5 (high), 2024-06-03: Transient DOS while processing an improperly formatted Fine Time Measurement (FTM) management frame.
• CVE-2023-43537 - CVSS 7.5 (high), 2024-06-03: Information disclosure while handling T2LM Action Frame in WLAN Host.
• CVE-2024-21477 - CVSS 7.5 (high), 2024-05-06: Transient DOS while parsing a protected 802.11az Fine Time Measurement (FTM) frame.
• CVE-2024-21473 - CVSS 9.8 (critical), 2024-04-01: Memory corruption while redirecting log file to any file location with any file name.
• CVE-2023-43553 - CVSS 9.8 (critical), 2024-03-04: Memory corruption while parsing beacon/probe response frame when AP sends more supported links in MLIE.
• CVE-2023-43552 - CVSS 9.8 (critical), 2024-03-04: Memory corruption while processing MBSSID beacon containing several subelement IE.
• CVE-2023-43549 - CVSS 8.4 (high), 2024-03-04: Memory corruption while processing TPC target power table in FTM TPC.
• CVE-2023-43539 - CVSS 7.5 (high), 2024-03-04: Transient DOS while processing an improperly formatted 802.11az Fine Time Measurement protocol frame.
• CVE-2023-33105 - CVSS 7.5 (high), 2024-03-04: Transient DOS in WLAN Host and Firmware when large number of open authentication frames are sent with an invalid transaction sequence number.
• CVE-2023-28578 - CVSS 9.3 (critical), 2024-03-04: Memory corruption in Core Services while executing the command for removing a single event listener.
• CVE-2023-43523 - CVSS 7.5 (high), 2024-02-06: Transient DOS while processing 11AZ RTT management action frame received through OTA.
• CVE-2023-43522 - CVSS 7.5 (high), 2024-02-06: Transient DOS while key unwrapping process, when the given encrypted key is empty or NULL.
• CVE-2023-43511 - CVSS 7.5 (high), 2024-01-02: Transient DOS while parsing IPv6 extension header when WLAN firmware receives an IPv6 packet that contains `IPPROTO_NONE` as the next header.
• CVE-2023-33116 - CVSS 7.5 (high), 2024-01-02: Transient DOS while parsing ieee80211_parse_mscs_ie in WIN WLAN driver.
• CVE-2023-33109 - CVSS 7.5 (high), 2024-01-02: Transient DOS while processing a WMI P2P listen start command (0xD00A) sent from host.
• CVE-2023-33062 - CVSS 7.5 (high), 2024-01-02: Transient DOS in WLAN Firmware while parsing a BTM request.
• CVE-2023-33032 - CVSS 9.3 (critical), 2024-01-02: Memory corruption in TZ Secure OS while requesting a memory allocation from TA region.
• CVE-2023-33030 - CVSS 9.3 (critical), 2024-01-02: Memory corruption in HLOS while running playready use-case.
• CVE-2023-33097 - CVSS 7.5 (high), 2023-12-05: Transient DOS in WLAN Firmware while processing a FTMR frame.
• CVE-2023-33098 - CVSS 7.5 (high), 2023-12-05: Transient DOS while parsing WPA IES, when it is passed with length more than expected size.
• CVE-2023-33083 - CVSS 9.8 (critical), 2023-12-05: Memory corruption in WLAN Host while processing RRM beacon on the AP.
• CVE-2023-33082 - CVSS 9.8 (critical), 2023-12-05: Memory corruption while sending an Assoc Request having BTM Query or BTM Response containing MBO IE.
• CVE-2023-33089 - CVSS 7.5 (high), 2023-12-05: Transient DOS when processing a NULL buffer while parsing WLAN vdev.
• CVE-2023-33088 - CVSS 8.4 (high), 2023-12-05: Memory corruption when processing cmd parameters while parsing vdev.
• CVE-2023-33080 - CVSS 7.5 (high), 2023-12-05: Transient DOS while parsing a vender specific IE (Information Element) of reassociation response management frame.
• CVE-2023-33063 - CVSS 7.8 (high), 2023-12-05: Memory corruption in DSP Services during a remote call from HLOS to DSP.
• CVE-2023-33081 - CVSS 7.5 (high), 2023-12-05: Transient DOS while converting TWT (Target Wake Time) frame parameters in the OTA broadcast.
• CVE-2023-33041 - CVSS 7.5 (high), 2023-12-05: Under certain scenarios the WLAN Firmware will reach an assertion due to state confusion while looking up peer ids.
• CVE-2023-33053 - CVSS 8.4 (high), 2023-12-05: Memory corruption in Kernel while parsing metadata.
• CVE-2023-28586 - CVSS 6.5 (medium), 2023-12-05: Information disclosure when the trusted application metadata symbol addresses are accessed while loading an ELF in TEE.
• CVE-2023-28585 - CVSS 8.8 (high), 2023-12-05: Memory corruption while loading an ELF segment in TEE Kernel.
• CVE-2023-28550 - CVSS 7.8 (high), 2023-12-05: Memory corruption in MPP performance while accessing DSM watermark using external memory address.
• CVE-2023-33061 - CVSS 7.5 (high), 2023-11-07: Transient DOS in WLAN Firmware while parsing WLAN beacon or probe-response frame.
• CVE-2023-33056 - CVSS 7.5 (high), 2023-11-07: Transient DOS in WLAN Firmware when firmware receives beacon including T2LM IE.
• CVE-2023-33048 - CVSS 7.5 (high), 2023-11-07: Transient DOS in WLAN Firmware while parsing t2lm buffers.
• CVE-2023-33047 - CVSS 7.5 (high), 2023-11-07: Transient DOS in WLAN Firmware while parsing no-inherit IES.
• CVE-2023-33045 - CVSS 9.8 (critical), 2023-11-07: Memory corruption in WLAN Firmware while parsing a NAN management frame carrying a S3 attribute.
• CVE-2023-28569 - CVSS 6.1 (medium), 2023-11-07: Information disclosure in WLAN HAL while handling command through WMI interfaces.
• CVE-2023-28563 - CVSS 6.1 (medium), 2023-11-07: Information disclosure in IOE Firmware while handling WMI command.
• CVE-2023-28554 - CVSS 6.1 (medium), 2023-11-07: Information Disclosure in Qualcomm IPC while reading values from shared memory in VM.
• CVE-2023-24852 - CVSS 8.4 (high), 2023-11-07: Memory Corruption in Core due to secure memory access by user while loading modem image.