CVE-2020-3617

HighCVSS 7.1/10Last modified Jun 17, 2026

Description

u'Buffer over-read Issue in Q6 testbus framework due to diag packet length is not completely validated before accessing the field and leads to Information disclosure.' in Snapdragon Compute, Snapdragon Consumer IOT, Snapdragon Industrial IOT, Snapdragon Mobile in Kamorta, Nicobar, QCS605, QCS610, Rennell, SC7180, SDA660, SDM630, SDM636, SDM660, SDM670, SDM710, SM6150, SM7150, SM8150, SXR1130

Metrics

CVSS 3.1 7.1/10CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H

Weakness enumeration

CWE-20 CWE-125

Affected software

Vendor	Product	Versions
Qualcomm, Inc.	Snapdragon Compute, Snapdragon Consumer IOT, Snapdragon Industrial IOT, Snapdragon Mobile	Kamorta, Nicobar, QCS605, QCS610, Rennell, SC7180, SDA660, SDM630, SDM636, SDM660, SDM670, SDM710, SM6150, SM7150, SM8150, SXR1130

References

https://www.qualcomm.com/company/product-security/bulletins/september-2020-bulletinVendor Advisory
https://www.qualcomm.com/company/product-security/bulletins/september-2020-bulletinVendor Advisory

Timeline

Published: Sep 9, 2020
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2020

CVE-2020-361705.3The Ultimate Member plugin before 2.1.13 for WordPress mishandles hidden name="timestamp" fields in forms.CVE-2020-361716.1The Elementor Website Builder plugin before 3.0.14 for WordPress does not properly restrict SVG uploads.CVE-2020-361726.1The Advanced Custom Fields plugin before 5.8.12 for WordPress mishandles the escaping of strings in Select2 dropdowns, potentially leading t CVE-2020-361735.3The Ninja Forms plugin before 3.4.28 for WordPress lacks escaping for submissions-table fields.CVE-2020-361746.5The Ninja Forms plugin before 3.4.27.1 for WordPress allows CSRF via services integration.CVE-2020-361755.3The Ninja Forms plugin before 3.4.27.1 for WordPress allows attackers to bypass validation via the email field.CVE-2020-361767.5The iThemes Security (formerly Better WP Security) plugin before 7.7.0 for WordPress does not enforce a new-password requirement for an exis CVE-2020-361779.8RsaPad_PSS in wolfcrypt/src/rsa.c in wolfSSL before 4.6.0 has an out-of-bounds write for certain relationships between key size and digest s CVE-2020-361789.8oal_ipt_addBridgeIsolationRules on TP-Link TL-WR840N 6_EU_0.9.1_4.16 devices allows OS command injection because a raw string entered from t CVE-2020-361798.1FasterXML jackson-databind 2.x before 2.9.10.8 mishandles the interaction between serialization gadgets and typing, related to oadd.org.apac CVE-2020-36187.8NULL exception due to accessing bad pointer while posting events on RT FIFO in Snapdragon Compute, Snapdragon Mobile, Snapdragon Wired Infra CVE-2020-361808.1FasterXML jackson-databind 2.x before 2.9.10.8 mishandles the interaction between serialization gadgets and typing, related to org.apache.co