Snapdragon X65 5g Modem Rf System Firmware
snapdragon_x65_5g_modem-rf_system_firmware
Vendor: Qualcomm • 215 CVEs
CVEs (215)
CVE VENDORS PRODUCTS UPDATED PUBLISHED CVSS |
|---|
1Qualcomm 240Aqt1000 Firmware Ar8035 FirmwareCsra6620 Firmware+237 moreJun 17, 2026 Apr 7, 2025 N/A· v4 6.2 MEDIUM· v3 N/A· v2 Cryptographic issue occurs during PIN/password verification using Gatekeeper, where RPMB writes can be dropped on verification failure, potentially leading to a user throttling bypass. |
1Qualcomm 158Ar8035 Firmware Fastconnect 6700 FirmwareFastconnect 6800 Firmware+155 moreJun 17, 2026 Apr 7, 2025 N/A· v4 7.7 HIGH· v3 N/A· v2 Information disclosure while creating MQ channels. |
1Qualcomm 164Ar8035 Firmware Fastconnect 6200 FirmwareFastconnect 6700 Firmware+161 moreJun 17, 2026 Apr 7, 2025 N/A· v4 7.1 HIGH· v3 N/A· v2 Cryptographic issues while generating an asymmetric key pair for RKP use cases. |
1Qualcomm 308315 5g Iot Modem Firmware 9205 Lte Modem FirmwareAqt1000 Firmware+305 moreJun 17, 2026 Apr 7, 2025 N/A· v4 5.5 MEDIUM· v3 N/A· v2 There may be information disclosure during memory re-allocation in TZ Secure OS. |
1Qualcomm 189Aqt1000 Firmware Ar8035 FirmwareFastconnect 6200 Firmware+186 moreJun 17, 2026 Apr 7, 2025 N/A· v4 7.5 HIGH· v3 N/A· v2 Memory corruption while assigning memory from the source DDR memory(HLOS) to ADSP. |
1Qualcomm 123Ar8035 Firmware Fastconnect 6900 FirmwareFastconnect 7800 Firmware+120 moreJun 17, 2026 Dec 2, 2024 N/A· v4 7.5 HIGH· v3 N/A· v2 Transient DOS while parsing the ML IE when a beacon with common info length of the ML IE greater than the ML IE inside which this element is present. |
1Qualcomm 323205 Mobile Platform Firmware 315 5g Iot Modem Firmware9205 Lte Modem Firmware+320 moreJun 17, 2026 Dec 2, 2024 N/A· v4 7.8 HIGH· v3 N/A· v2 Memory corruption when allocating and accessing an entry in an SMEM partition continuously. |
1Qualcomm 208315 5g Iot Modem Firmware Aqt1000 FirmwareAr8035 Firmware+205 moreJun 17, 2026 Dec 2, 2024 N/A· v4 7.8 HIGH· v3 N/A· v2 Memory corruption while Configuring the SMR/S2CR register in Bypass mode. |
1Qualcomm 203205 Mobile Platform Firmware 215 Mobile Platform Firmware315 5g Iot Modem Firmware+200 moreJun 17, 2026 Nov 4, 2024 N/A· v4 7.8 HIGH· v3 N/A· v2 Memory corruption while processing GPU page table switch. |
1Qualcomm 172215 Mobile Platform Firmware Ar8035 FirmwareCsra6620 Firmware+169 moreJun 17, 2026 Nov 4, 2024 N/A· v4 7.8 HIGH· v3 N/A· v2 Memory corruption while handling session errors from firmware. |
1Qualcomm 229315 5g Iot Modem Firmware Aqt1000 FirmwareAr8035 Firmware+226 moreJun 17, 2026 Nov 4, 2024 N/A· v4 9.1 CRITICAL· v3 N/A· v2 Cryptographic issue when a controller receives an LMP start encryption command under unexpected conditions. |
1Qualcomm 121Ar8035 Firmware Fastconnect 6900 FirmwareFastconnect 7800 Firmware+118 moreJun 17, 2026 Nov 4, 2024 N/A· v4 6.5 MEDIUM· v3 N/A· v2 Transient DOS while parsing fragments of MBSSID IE from beacon frame. |
1Qualcomm 91205 Mobile Platform Firmware Apq8017 FirmwareApq8037 Firmware+88 moreJun 17, 2026 Nov 4, 2024 N/A· v4 6.5 MEDIUM· v3 N/A· v2 Transient DOS as modem reset occurs when an unexpected MAC RAR (with invalid PDU length) is seen at UE. |
1Qualcomm 115Ar8035 Firmware Fastconnect 6700 FirmwareFastconnect 6900 Firmware+112 moreJun 17, 2026 Oct 7, 2024 N/A· v4 7.5 HIGH· v3 N/A· v2 Transient DOS while parsing probe response and assoc response frame. |
1Qualcomm 158Ar8035 Firmware Csr8811 FirmwareFastconnect 6700 Firmware+155 moreJun 17, 2026 Oct 7, 2024 N/A· v4 8.2 HIGH· v3 N/A· v2 Information disclosure while parsing the BSS parameter change count or MLD capabilities fields of the ML IE. |
1Qualcomm 71Csr8811 Firmware Immersive Home 214 Platform FirmwareImmersive Home 216 Platform Firmware+68 moreJun 17, 2026 Oct 7, 2024 N/A· v4 9.8 CRITICAL· v3 N/A· v2 Memory corruption while redirecting log file to any file location with any file name. |
1Qualcomm 131Csr8811 Firmware Fastconnect 6700 FirmwareFastconnect 7800 Firmware+128 moreJun 17, 2026 Oct 7, 2024 N/A· v4 7.5 HIGH· v3 N/A· v2 Transient DOS while parsing noninheritance IE of Extension element when length of IE is 2 of beacon frame. |
1Qualcomm 118Ar8035 Firmware Fastconnect 6200 FirmwareFastconnect 6700 Firmware+115 moreJun 17, 2026 Oct 7, 2024 N/A· v4 7.8 HIGH· v3 N/A· v2 Memory corruption when invalid length is provided from HLOS for FRS/UDS request/response buffers. |
1Qualcomm 243215 Mobile Firmware 315 5g Iot FirmwareAqt1000 Firmware+240 moreJun 17, 2026 Sep 2, 2024 N/A· v4 7.8 HIGH· v3 N/A· v2 Memory corruption when two threads try to map and unmap a single node simultaneously. |
1Qualcomm 170Ar8035 Firmware Csr8811 FirmwareFastconnect 6700 Firmware+167 moreJun 17, 2026 Sep 2, 2024 N/A· v4 7.5 HIGH· v3 N/A· v2 Transient DOS while parsing the multi-link element Control field when common information length check is missing before updating the location. |