CVE-2022-40537 is a critical memory corruption vulnerability affecting Qualcomm Bluetooth HOST components. It arises from improper handling of AVRC_PDU_GET_PLAYER_APP_VALUE_TEXT AVRCP responses, allowing an unauthenticated attacker to execute arbitrary code or cause a denial of service over the network with low complexity. With a CVSS score of 9.8, this flaw poses a severe risk of complete compromise of confidentiality, integrity, and availability. While no public exploits, Metasploit modules, or community discussions have been observed, the high severity warrants immediate patching.
| Vendor | Product | Version(s) | CPE |
|---|---|---|---|
Range not provided by sourceCPE matchmatch criteria | cpe:2.3:o:qualcomm:apq8009_firmware:-:*:*:*:*:*:*:* | ||
Range not provided by sourceCPE matchmatch criteria | cpe:2.3:o:qualcomm:apq8009w_firmware:-:*:*:*:*:*:*:* | ||
Range not provided by sourceCPE matchmatch criteria | cpe:2.3:o:qualcomm:apq8017_firmware:-:*:*:*:*:*:*:* | ||
Range not provided by sourceCPE matchmatch criteria | cpe:2.3:o:qualcomm:apq8064au_firmware:-:*:*:*:*:*:*:* | ||
Range not provided by sourceCPE matchmatch criteria | cpe:2.3:o:qualcomm:apq8096au_firmware:-:*:*:*:*:*:*:* |
CVSS version used by this source: 3.1
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L
The average CVE in this peer group has 0.0 Twitter, 0.1 Reddit, 0.3 Bluesky, 0.3 Mastodon, and 2.4 GitHub mentions.
No media coverage found for this CVE.
The average CVE in this peer group has 0.3 InfoSec Media, 0.0 Vendor Blog, and 0.0 Security Researcher mentions.
Remediation records are not available for this CVE.