CVE-2023-21631

CriticalCVSS 9.8/10Last modified Jun 17, 2026

Description

Weak Configuration due to improper input validation in Modem while processing LTE security mode command message received from network.

Metrics

CVSS 3.1 9.8/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-20

Affected software

VendorProductVersions
Qualcomm, Inc.Snapdragon315 5G IoT Modem; 9205 LTE Modem; APQ8017; APQ8037; AQT1000; AR8035; C-V2X 9150; CSRA6620; CSRA6640; CSRB31024; FastConnect 6200; FastConnect 6700; FastConnect 6800; FastConnect 6900; FastConnect 7800; MDM9628; MSM8108; MSM8209; MSM8608; MSM8909W

References

Timeline

Published
Jul 4, 2023
Last modified
Jun 17, 2026
NVD status
Modified

Related CVEs from 2023

CVE-2023-216327.8Memory corruption in Automotive GPU while querying a gsl memory node.CVE-2023-216337.8Memory Corruption in Linux while processing QcRilRequestImsRegisterMultiIdentityMessage request.CVE-2023-216347.8Memory Corruption in Radio Interface Layer while sending an SMS or writing an SMS to SIM.CVE-2023-216357.8Memory Corruption in Data Network Stack & Connectivity when sim gets detected on telephony.CVE-2023-216367.8Memory Corruption due to improper validation of array index in Linux while updating adn record.CVE-2023-216377.8Memory corruption in Linux while calling system configuration APIs.CVE-2023-216387.8Memory corruption in Video while calling APIs with different instance ID than the one received in initialization.CVE-2023-216397.8Memory corruption in Audio while processing sva_model_serializer using memory size passed by HIDL client.CVE-2023-21645.4An issue has been discovered in GitLab affecting all versions starting from 15.9 before 16.0.8, all versions starting from 16.1 before 16.1.CVE-2023-216407.8Memory corruption in Linux when the file upload API is called with parameters having large buffer.CVE-2023-216417.8An app with non-privileged access can change global system brightness and cause undesired system behavior.CVE-2023-216427.8Memory corruption in HAB Memory management due to broad system privileges via physical address.
CVE-2023-21631: Critical severity, CVSS 9.8 | Vulnix