CVE-2020-11134: qualcomm aqt1000_firmware Improper Validation of Array Index
Vulnerability summary
CVE-2020-11134 is a high (CVSS 10.0) Improper Validation of Array Index vulnerability in qualcomm aqt1000_firmware. EPSS estimates a 0.80% chance of exploitation in the next 30 days, higher than 55.7% of scored vulnerabilities.
Timeline
- 09-06-2021PublishedVulnerability first disclosed.
- 04-08-2024Last modifiedVulnerability information updated.
Description
Possible stack out of bound write might happen due to time bitmap length and bit duration fields of the attributes like NAN ranging setup attribute inside a NAN management frame are not Properly validated in Snapdragon Auto, Snapdragon Compute, Snapdragon Connectivity, Snapdragon Consumer Electronics Connectivity, Snapdragon Consumer IOT, Snapdragon Industrial IOT, Snapdragon Mobile, Snapdragon Voice & Music, Snapdragon Wired Infrastructure and Networking
CVSS metrics
2 scores · 1 source · 2 versionsEPSS trend
Probability
0.80%
Chance of exploitation in the next 30 days
Percentile
56%
Versus all other CVEs
30-day change
0.00 pp
From 0.80% on 20-09-2026
Known exploited
Compare KEV catalogsNot in any of the 3 tracked catalogs.
Public exploits
0 foundNo public exploits indexed.
Weaknesses
CWE · root cause- CWE-129Improper Validation of Array IndexThe product uses untrusted input when calculating or using an array index, but the product does not validate or incorrectly validates the index to ensure the index references a valid position within the array.
- CWE-787Out-of-bounds WriteThe product writes data past the end, or before the beginning, of the intended buffer.
Affected systems
Qualcomm200 products
1 vendor · 200 products · Showing 200 of 325. Use Open JSON for the complete list.
References
1 links- www.qualcomm.com/company/product-security/bulletins/january-2021-bulletinX Refsource CONFIRMVendor Advisory