{"schemaVersion":3,"id":"CVE-2020-11117","aliases":[],"status":"published","duplicateOf":null,"title":null,"description":"u'In the lbd service, an external user can issue a specially crafted debug command to overwrite arbitrary files with arbitrary content resulting in remote code execution.' in Snapdragon Connectivity, Snapdragon Consumer IOT, Snapdragon Wired Infrastructure and Networking in IPQ4019, IPQ6018, IPQ8064, IPQ8074, QCA4531, QCA9531, QCA9980","dates":{"published":"2020-09-08T09:31:35.000Z","modified":"2024-08-04T11:21:14.657Z","reserved":null,"kevAdded":[],"kevDue":[]},"cvss":{"headline":{"score":9.8,"severity":"critical","version":"3.1","versionLabel":"v3.1","source":"NVD","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","computed":false,"selection":"backend-summary"},"metrics":[{"version":"3.1","versionLabel":"v3.1","source":"NVD","score":9.8,"severity":"critical","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","exploitability":null,"impact":null,"computed":false},{"version":"2.0","versionLabel":"v2.0","source":"NVD","score":7.5,"severity":"high","vector":"AV:N/AC:L/Au:N/C:P/I:P/A:P","exploitability":null,"impact":null,"computed":false}]},"epss":{"probability":0.19677,"percentile":0.97388,"severity":"medium","asOf":"2026-10-21T00:00:00.000Z","change":{"pp":0,"baselineDate":"2026-09-21T00:00:00.000Z","baselineScore":0.19677},"history":[{"date":"2026-09-14T00:00:00.000Z","score":0.19677,"percentile":null},{"date":"2026-09-15T00:00:00.000Z","score":0.19677,"percentile":null},{"date":"2026-09-16T00:00:00.000Z","score":0.19677,"percentile":null},{"date":"2026-09-17T00:00:00.000Z","score":0.19677,"percentile":null},{"date":"2026-09-18T00:00:00.000Z","score":0.19677,"percentile":null},{"date":"2026-09-19T00:00:00.000Z","score":0.19677,"percentile":null},{"date":"2026-09-20T00:00:00.000Z","score":0.19677,"percentile":null},{"date":"2026-09-21T00:00:00.000Z","score":0.19677,"percentile":null},{"date":"2026-09-22T00:00:00.000Z","score":0.19677,"percentile":null},{"date":"2026-09-23T00:00:00.000Z","score":0.19677,"percentile":null},{"date":"2026-09-24T00:00:00.000Z","score":0.19677,"percentile":null},{"date":"2026-09-25T00:00:00.000Z","score":0.19677,"percentile":null},{"date":"2026-09-26T00:00:00.000Z","score":0.19677,"percentile":null},{"date":"2026-09-27T00:00:00.000Z","score":0.19677,"percentile":null},{"date":"2026-09-28T00:00:00.000Z","score":0.19677,"percentile":null},{"date":"2026-09-29T00:00:00.000Z","score":0.19677,"percentile":null},{"date":"2026-09-30T00:00:00.000Z","score":0.19677,"percentile":null},{"date":"2026-10-01T00:00:00.000Z","score":0.19677,"percentile":null},{"date":"2026-10-02T00:00:00.000Z","score":0.19677,"percentile":null},{"date":"2026-10-03T00:00:00.000Z","score":0.19677,"percentile":null},{"date":"2026-10-04T00:00:00.000Z","score":0.19677,"percentile":null},{"date":"2026-10-05T00:00:00.000Z","score":0.19677,"percentile":null},{"date":"2026-10-06T00:00:00.000Z","score":0.19677,"percentile":null},{"date":"2026-10-07T00:00:00.000Z","score":0.19677,"percentile":null},{"date":"2026-10-08T00:00:00.000Z","score":0.19677,"percentile":null},{"date":"2026-10-09T00:00:00.000Z","score":0.19677,"percentile":null},{"date":"2026-10-10T00:00:00.000Z","score":0.19677,"percentile":null},{"date":"2026-10-11T00:00:00.000Z","score":0.19677,"percentile":null},{"date":"2026-10-12T00:00:00.000Z","score":0.19677,"percentile":null},{"date":"2026-10-13T00:00:00.000Z","score":0.19677,"percentile":null},{"date":"2026-10-14T00:00:00.000Z","score":0.19677,"percentile":null},{"date":"2026-10-15T00:00:00.000Z","score":0.19677,"percentile":null},{"date":"2026-10-16T00:00:00.000Z","score":0.19677,"percentile":null},{"date":"2026-10-17T00:00:00.000Z","score":0.19677,"percentile":null},{"date":"2026-10-18T00:00:00.000Z","score":0.19677,"percentile":null},{"date":"2026-10-19T00:00:00.000Z","score":0.19677,"percentile":null},{"date":"2026-10-20T00:00:00.000Z","score":0.19677,"percentile":null},{"date":"2026-10-21T00:00:00.000Z","score":0.19677,"percentile":0.97388}],"last30":[{"date":"2026-09-21T00:00:00.000Z","score":0.19677,"percentile":null},{"date":"2026-09-22T00:00:00.000Z","score":0.19677,"percentile":null},{"date":"2026-09-23T00:00:00.000Z","score":0.19677,"percentile":null},{"date":"2026-09-24T00:00:00.000Z","score":0.19677,"percentile":null},{"date":"2026-09-25T00:00:00.000Z","score":0.19677,"percentile":null},{"date":"2026-09-26T00:00:00.000Z","score":0.19677,"percentile":null},{"date":"2026-09-27T00:00:00.000Z","score":0.19677,"percentile":null},{"date":"2026-09-28T00:00:00.000Z","score":0.19677,"percentile":null},{"date":"2026-09-29T00:00:00.000Z","score":0.19677,"percentile":null},{"date":"2026-09-30T00:00:00.000Z","score":0.19677,"percentile":null},{"date":"2026-10-01T00:00:00.000Z","score":0.19677,"percentile":null},{"date":"2026-10-02T00:00:00.000Z","score":0.19677,"percentile":null},{"date":"2026-10-03T00:00:00.000Z","score":0.19677,"percentile":null},{"date":"2026-10-04T00:00:00.000Z","score":0.19677,"percentile":null},{"date":"2026-10-05T00:00:00.000Z","score":0.19677,"percentile":null},{"date":"2026-10-06T00:00:00.000Z","score":0.19677,"percentile":null},{"date":"2026-10-07T00:00:00.000Z","score":0.19677,"percentile":null},{"date":"2026-10-08T00:00:00.000Z","score":0.19677,"percentile":null},{"date":"2026-10-09T00:00:00.000Z","score":0.19677,"percentile":null},{"date":"2026-10-10T00:00:00.000Z","score":0.19677,"percentile":null},{"date":"2026-10-11T00:00:00.000Z","score":0.19677,"percentile":null},{"date":"2026-10-12T00:00:00.000Z","score":0.19677,"percentile":null},{"date":"2026-10-13T00:00:00.000Z","score":0.19677,"percentile":null},{"date":"2026-10-14T00:00:00.000Z","score":0.19677,"percentile":null},{"date":"2026-10-15T00:00:00.000Z","score":0.19677,"percentile":null},{"date":"2026-10-16T00:00:00.000Z","score":0.19677,"percentile":null},{"date":"2026-10-17T00:00:00.000Z","score":0.19677,"percentile":null},{"date":"2026-10-18T00:00:00.000Z","score":0.19677,"percentile":null},{"date":"2026-10-19T00:00:00.000Z","score":0.19677,"percentile":null},{"date":"2026-10-20T00:00:00.000Z","score":0.19677,"percentile":null},{"date":"2026-10-21T00:00:00.000Z","score":0.19677,"percentile":0.97388}]},"kev":{"state":"not-listed","entries":[],"listedCount":0,"totalCatalogs":3,"catalogs":[{"source":"cisa","label":"CISA","listed":false,"entry":null},{"source":"enisa","label":"ENISA","listed":false,"entry":null},{"source":"circl","label":"CIRCL","listed":false,"entry":null}]},"ransomware":{"state":"none-recorded","sources":[]},"exploits":[{"id":"REF_87EDDBF11FFBBAA4","name":"Exploit Reference (talosintelligence.com)","source":"reference","url":"https://www.talosintelligence.com/vulnerability_reports/TALOS-2020-1065","maturity":"unknown","reliabilityScore":0.2,"verified":false,"type":null,"platforms":[],"requiresAuth":null,"exploitdb":null,"metasploit":null}],"exploitCount":1,"weaknesses":[{"id":"CWE-77","name":"Improper Neutralization of Special Elements used in a Command ('Command Injection')","description":"The product constructs all or part of a command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended command when it is sent to a downstream component.","type":"weakness","status":"Draft","abstraction":"Class","likelihoodOfExploit":"High","url":"https://cwe.mitre.org/data/definitions/77.html"}],"affected":[{"vendor":"qualcomm, inc.","product":"snapdragon connectivity, snapdragon consumer iot, snapdragon wired infrastructure and networking","name":"Snapdragon Connectivity, Snapdragon Consumer IOT, Snapdragon Wired Infrastructure and Networking","label":"snapdragon connectivity, snapdragon consumer iot, snapdragon wired infrastructure and networking","ecosystem":null,"cpePart":"a","purl":null,"purlType":null,"versions":[{"text":"IPQ4019, IPQ6018, IPQ8064, IPQ8074, QCA4531, QCA9531, QCA9980","noFixRecorded":false,"fixedIn":null}],"versionsText":"IPQ4019, IPQ6018, IPQ8064, IPQ8074, QCA4531, QCA9531, QCA9980","eol":null,"hubHref":"/vendor/qualcomm_inc/snapdragon_connectivity_snapdragon_consumer_iot_snapdragon_wired_infrastructure_and_networking"},{"vendor":"qualcomm","product":"ipq4019_firmware","name":"ipq4019 firmware","label":"ipq4019_firmware","ecosystem":null,"cpePart":"o","purl":null,"purlType":null,"versions":[{"text":"na","noFixRecorded":false,"fixedIn":null}],"versionsText":"na","eol":null,"hubHref":"/vendor/qualcomm/ipq4019"},{"vendor":"qualcomm","product":"ipq6018_firmware","name":"ipq6018 firmware","label":"ipq6018_firmware","ecosystem":null,"cpePart":"o","purl":null,"purlType":null,"versions":[{"text":"na","noFixRecorded":false,"fixedIn":null}],"versionsText":"na","eol":null,"hubHref":"/vendor/qualcomm/ipq6018"},{"vendor":"qualcomm","product":"ipq8064_firmware","name":"ipq8064 firmware","label":"ipq8064_firmware","ecosystem":null,"cpePart":"o","purl":null,"purlType":null,"versions":[{"text":"na","noFixRecorded":false,"fixedIn":null}],"versionsText":"na","eol":null,"hubHref":"/vendor/qualcomm/ipq8064"},{"vendor":"qualcomm","product":"ipq8074_firmware","name":"ipq8074 firmware","label":"ipq8074_firmware","ecosystem":null,"cpePart":"o","purl":null,"purlType":null,"versions":[{"text":"na","noFixRecorded":false,"fixedIn":null}],"versionsText":"na","eol":null,"hubHref":"/vendor/qualcomm/ipq8074"},{"vendor":"qualcomm","product":"qca4531_firmware","name":"qca4531 firmware","label":"qca4531_firmware","ecosystem":null,"cpePart":"o","purl":null,"purlType":null,"versions":[{"text":"na","noFixRecorded":false,"fixedIn":null}],"versionsText":"na","eol":null,"hubHref":"/vendor/qualcomm/qca4531"},{"vendor":"qualcomm","product":"qca9531_firmware","name":"qca9531 firmware","label":"qca9531_firmware","ecosystem":null,"cpePart":"o","purl":null,"purlType":null,"versions":[{"text":"na","noFixRecorded":false,"fixedIn":null}],"versionsText":"na","eol":null,"hubHref":"/vendor/qualcomm/qca9531"},{"vendor":"qualcomm","product":"qca9980_firmware","name":"qca9980 firmware","label":"qca9980_firmware","ecosystem":null,"cpePart":"o","purl":null,"purlType":null,"versions":[{"text":"na","noFixRecorded":false,"fixedIn":null}],"versionsText":"na","eol":null,"hubHref":"/vendor/qualcomm/qca9980"}],"affectedCount":8,"eol":{"hasEol":false,"count":0},"references":[{"url":"https://www.qualcomm.com/company/product-security/bulletins/august-2020-bulletin","label":"www.qualcomm.com/company/product-security/bulletins/august-2020-bulletin","hostname":"www.qualcomm.com","tags":["X Refsource CONFIRM","Broken Link"]},{"url":"https://www.talosintelligence.com/vulnerability_reports/TALOS-2020-1065","label":"www.talosintelligence.com/vulnerability_reports/TALOS-2020-1065","hostname":"www.talosintelligence.com","tags":["X Refsource MISC","Exploit","Third Party Advisory"]}],"lineage":{"upstream":[],"downstream":[],"duplicates":[],"related":[]},"timeline":[{"kind":"published","date":"2020-09-08T09:31:35.000Z","label":"Published","detail":"Vulnerability first disclosed.","source":null},{"kind":"modified","date":"2024-08-04T11:21:14.657Z","label":"Last modified","detail":"Vulnerability information updated.","source":null}],"risk":{"score":70,"level":"high","profile":"Default","thresholds":{"critical":75,"high":50,"medium":25,"low":10}},"meta":{"dataAsOf":"2026-10-21T16:04:51.271Z","stale":false,"partial":false}}