First day on Intigriti: our agent harness found and proved a remote code execution bug in Odoo's program.

CVE-2024-43049

HighCVSS 7.8/10Last modified Jun 17, 2026

Description

Memory corruption while invoking IOCTL calls from user space to set generic private command inside WLAN driver.

Metrics

CVSS 3.1 7.8/10CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-119 CWE-787

Affected software

Vendor	Product	Versions
Qualcomm, Inc.	Snapdragon	FastConnect 6700; FastConnect 6900; FastConnect 7800; QCC2073; QCC2076; SC8380XP; SDM429W; Snapdragon 429 Mobile Platform; Snapdragon 7c+ Gen 3 Compute; Snapdragon 8cx Gen 3 Compute Platform (SC8280XP-AB, BB); WCD9380; WCD9385; WCN3620; WCN3660B; WSA8830; WSA8835; WSA8840; WSA8845; WSA8845H
qualcomm	fastconnect_6700_firmware	<= *
qualcomm	fastconnect_6900_firmware	<= *
qualcomm	fastconnect_7800_firmware	<= *
qualcomm	qcc2073_firmware	<= *
qualcomm	qcc2076_firmware	<= *
qualcomm	sc8380xp_firmware	<= *
qualcomm	sdm429w_firmware	<= *
qualcomm	snapdragon_429_mobile_platform_firmware	<= *
qualcomm	wcd9380_firmware	<= *
qualcomm	wcd9385_firmware	<= *
qualcomm	wcn3620_firmware	<= *
qualcomm	wcn3660b_firmware	<= *
qualcomm	wsa8830_firmware	<= *
qualcomm	wsa8835_firmware	<= *
qualcomm	wsa8840_firmware	<= *
qualcomm	wsa8845_firmware	<= *
qualcomm	wsa8845h_firmware	<= *

References

https://docs.qualcomm.com/product/publicresources/securitybulletin/december-2024-bulletin.htmlVendor Advisory

Timeline

Published: Dec 2, 2024
Last modified: Jun 17, 2026
NVD status: Analyzed

Related CVEs from 2024

CVE-2024-43056.8The Post Grid Gutenberg Blocks and WordPress Blog Plugin WordPress plugin before 4.1.0 does not validate and escape some of its block optio CVE-2024-430507.8Memory corruption while invoking IOCTL calls from user space to issue factory test command inside WLAN driver.CVE-2024-430515.5Information disclosure while deriving keys for a session for any Widevine use case.CVE-2024-430527.8Memory corruption while processing API calls to NPU with invalid input.CVE-2024-430537.8Memory corruption while invoking IOCTL calls from user space to read WLAN target diagnostic information.CVE-2024-430557.8Memory corruption while processing camera use case IOCTL call.CVE-2024-430566.5Transient DOS during hypervisor virtual I/O operation in a virtual machine.CVE-2024-430577.8Memory corruption while processing command in Glink linux.CVE-2024-430587.8Memory corruption while processing IOCTL calls.CVE-2024-430597.8Memory corruption while invoking IOCTL calls from the use-space for HGSL memory node.CVE-2024-43068.8Critical unrestricted file upload vulnerability in HubBank affecting version 1.0.2. This vulnerability allows a registered user to upload ma CVE-2024-430607.8Memory corruption during voice activation, when sound model parameters are loaded from HLOS to ADSP.

CVE-2024-43049: High severity, CVSS 7.8 | Vulnix