CVE-2016-10434: qualcomm, inc. snapdragon automobile, snapdragon mobile Improper Authentication
Vulnerability summary
CVE-2016-10434 is a high (CVSS 7.5) Improper Authentication vulnerability in qualcomm, inc. snapdragon automobile, snapdragon mobile. EPSS estimates a 0.80% chance of exploitation in the next 30 days, higher than 55.9% of scored vulnerabilities.
Timeline
- 18-04-2018PublishedVulnerability first disclosed.
- 16-09-2024Last modifiedVulnerability information updated.
Description
In Android before 2018-04-05 or earlier security patch level on Qualcomm Snapdragon Automobile and Snapdragon Mobile SD 820 and SD 820A, the input to RPMB write response function is a buffer from HLOS that needs to be authenticated (using HMAC) and then processed. However, some of the processing occurs before the buffer is authenticated. The function will return various types of errors depending on the values of the `response` and `result` fields of the buffer before verifying the HMAC tag.
CVSS metrics
2 scores · 1 source · 2 versionsEPSS trend
Probability
0.80%
Chance of exploitation in the next 30 days
Percentile
56%
Versus all other CVEs
30-day change
+0.10 pp
From 0.69% on 21-09-2026
Known exploited
Compare KEV catalogsNot in any of the 3 tracked catalogs.
Public exploits
0 foundNo public exploits indexed.
Weaknesses
CWE · root causeAffected systems
Qualcomm2 products
Qualcomm, inc.1 product
- snapdragon automobile, snapdragon mobileSD 820, SD 820A
2 vendors · 3 products