Improper authentication in Qualcomm Snapdragon Automobile, Snapdragon Mobile
Key facts
- Attack vector
- Network
- Privileges required
- None
- User interaction
- None
- Attack complexity
- Low
- Impact type
- Security bypass
- Confidentiality · integrity · availability
- High · None · None
- Fix status
- No fix listed
Attack profile from CVSS 3.0 · NVD. Fix status from CNA. Impact type from CWE-287.
Summary
In Android before 2018-04-05 or earlier security patch level on Qualcomm Snapdragon Automobile and Snapdragon Mobile SD 820 and SD 820A, the input to RPMB write response function is a buffer from HLOS that needs to be authenticated (using HMAC) and then processed. However, some of the processing occurs before the buffer is authenticated. The function will return various types of errors depending on the values of the `response` and `result` fields of the buffer before verifying the HMAC tag.
Why it matters now
SSVC decision points
Not available: CISA has not published SSVC decision points for this record.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| Qualcomm | Snapdragon Automobile, Snapdragon Mobile | SD 820, SD 820A | — | No fix listed | CNA |
- Snapdragon Automobile, Snapdragon Mobile VendorQualcomm Affected SD 820, SD 820A Fixed in — No fix listed CNA
CPE configurations NVD · 4
| CPE | Versions | Role | Vendor |
|---|---|---|---|
| cpe:2.3:o:qualcomm:sd_820_firmware:-:*:*:*:*:*:*:* | not specified by NVD | Vulnerable | Qualcomm |
| cpe:2.3:h:qualcomm:sd_820:-:*:*:*:*:*:*:* | not specified by NVD | Running on | Qualcomm |
| cpe:2.3:o:qualcomm:sd_820a_firmware:-:*:*:*:*:*:*:* | not specified by NVD | Vulnerable | Qualcomm |
| cpe:2.3:h:qualcomm:sd_820a:-:*:*:*:*:*:*:* | not specified by NVD | Running on | Qualcomm |
- cpe:2.3:o:qualcomm:sd_820_firmware:-:*:*:*:*:*:*:* Versions not specified by NVD Vulnerable ·Qualcomm
- cpe:2.3:h:qualcomm:sd_820:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Qualcomm
- cpe:2.3:o:qualcomm:sd_820a_firmware:-:*:*:*:*:*:*:* Versions not specified by NVD Vulnerable ·Qualcomm
- cpe:2.3:h:qualcomm:sd_820a:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Qualcomm
Remediation
No fixed version listed by the sources yet.
Timeline
- 2026-10-02 Threatist record created from CVE-2016-10434
- 2026-10-03 Alias added: GHSA-qqcm-m6q5-fq97
References
More Qualcomm Sd 820 Firmware vulnerabilities
- TI-2017-10935 Improper authentication in Qualcomm Snapdragon IoT, Snapdragon Mobile, Snapdragon… CVSS 3.0CRITICAL 9.8
- TI-2019-01911 Out-of-bounds read in Qualcomm Snapdragon Auto, Snapdragon Consumer Electronics… CVSS 3.0CRITICAL 9.8
- TI-2019-01868 An unprivileged user can craft a bitstream such that the payload encoded in the bitstream… CVSS 3.0CRITICAL 9.8
- TI-2019-01867 An unprivileged user can craft a bitstream such that the payload encoded in the bitstream… CVSS 3.0CRITICAL 9.8
- TI-2018-08564 Out-of-bounds write in Qualcomm Snapdragon Auto, Snapdragon Compute, Snapdragon Consumer… CVSS 3.0CRITICAL 9.8
- TI-2018-04311 Exception in Modem IP stack while processing IPv6 packet in snapdragon automobile… CVSS 3.0CRITICAL 9.8
Sources
- CVE-2016-10434 · CVE Program
- CVE-2016-10434 · NVD
- FIRST EPSS
- GHSA-qqcm-m6q5-fq97 · GitHub Advisory Database · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences