CVE-2022-33302

HighCVSS 7.8/10Last modified Jun 17, 2026

Description

Memory corruption due to improper validation of array index in User Identity Module when APN TLV length is greater than command length.

Metrics

CVSS 3.1 7.8/10CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-129

Affected software

Vendor	Product	Versions
Qualcomm, Inc.	Snapdragon	315 5G IoT Modem; 9205 LTE Modem; 9206 LTE Modem; 9207 LTE Modem; APQ8017; APQ8037; AQT1000; AR6003; AR8035; C-V2X 9150; CSRA6620; CSRA6640; CSRB31024; FastConnect 6200; FastConnect 6700; FastConnect 6800; FastConnect 6900; FastConnect 7800; MDM8207; MDM8215

References

https://www.qualcomm.com/company/product-security/bulletins/april-2023-bulletinVendor Advisory
https://www.qualcomm.com/company/product-security/bulletins/april-2023-bulletinVendor Advisory

Timeline

Published: Apr 13, 2023
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2022

CVE-2022-333035.5Transient DOS due to uncontrolled resource consumption in Linux kernel when malformed messages are sent from the Gunyah Resource Manager mes CVE-2022-333047.5Transient DOS due to NULL pointer dereference in Modem while performing pullup for received TCP/UDP packet.CVE-2022-333057.5Transient DOS due to NULL pointer dereference in Modem while sending invalid messages in DCCH.CVE-2022-333067.5Transient DOS due to buffer over-read in WLAN while processing an incoming management frame with incorrectly filled IEs.CVE-2022-333077.8Memory Corruption due to double free in automotive when a bad HLOS address for one of the lists to be mapped is passed.CVE-2022-333097.5Transient DOS due to buffer over-read in WLAN Firmware while parsing secure FTMR frame with size lesser than 39 Bytes.CVE-2022-33314.3An issue has been discovered in GitLab EE affecting all versions starting from 14.5 before 15.1.6, all versions starting from 15.2 before 15 CVE-2022-333114.3Browse restriction bypass vulnerability in Address Book of Cybozu Office 10.0.0 to 10.8.5 allows a remote authenticated attacker to obtain t CVE-2022-333129.8Multiple command injection vulnerabilities exist in the web_server action endpoints functionalities of Robustel R1510 3.3.0. A specially-cra CVE-2022-333139.8Multiple command injection vulnerabilities exist in the web_server action endpoints functionalities of Robustel R1510 3.3.0. A specially-cra CVE-2022-333149.8Multiple command injection vulnerabilities exist in the web_server action endpoints functionalities of Robustel R1510 3.3.0. A specially-cra CVE-2022-333157.8Deserialization of Untrusted Data vulnerability in Mitsubishi Electric GENESIS64 versions 10.97 to 10.97.1, Mitsubishi Electric Iconics Digi