CVE-2019-10540 is a critical buffer overflow vulnerability in the WLAN NAN function of various Qualcomm Snapdragon products, including mobile, automotive, and IoT platforms. This flaw, stemming from insufficient validation of the 'count' value in NAN availability attributes, allows for remote code execution without user interaction. With a CVSS score of 9.8, it poses a severe risk of complete compromise (confidentiality, integrity, and availability). While no public exploit code or active exploitation has been confirmed, the vulnerability has garnered some community discussion and media attention, notably regarding potential over-the-air Android attacks.
| Vendor | Product | Version(s) | CPE |
|---|---|---|---|
Range not provided by sourceCPE matchmatch criteria | cpe:2.3:o:qualcomm:ipq8074_firmware:-:*:*:*:*:*:*:* | ||
Range not provided by sourceCPE matchmatch criteria | cpe:2.3:o:qualcomm:msm8996au_firmware:-:*:*:*:*:*:*:* | ||
Range not provided by sourceCPE matchmatch criteria | cpe:2.3:o:qualcomm:qca6174a_firmware:-:*:*:*:*:*:*:* | ||
Range not provided by sourceCPE matchmatch criteria | cpe:2.3:o:qualcomm:qca6574au_firmware:-:*:*:*:*:*:*:* | ||
Range not provided by sourceCPE matchmatch criteria | cpe:2.3:o:qualcomm:qca8081_firmware:-:*:*:*:*:*:*:* |
CVSS version used by this source: 3.1
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
The average CVE in this peer group has 0.0 Twitter, 0.1 Reddit, 0.3 Bluesky, 0.3 Mastodon, and 2.4 GitHub mentions.
The average CVE in this peer group has 0.3 InfoSec Media, 0.0 Vendor Blog, and 0.0 Security Researcher mentions.
Remediation records are not available for this CVE.