TI-2017-10937 Aliases CVE-2017-14913 GHSA-p2cf-g38m-4mw6

Improper input validation in Qualcomm Snapdragon IoT, Snapdragon Mobile

MEDIUM 45CWE-20Published 2018-03-30 · Updated 2024-09-16

Key facts

Attack vector: Network
Privileges required: None
User interaction: None
Attack complexity: Low
Impact type: —
Confidentiality · integrity · availability: High · High · High
Fix status: No fix listed

Attack profile from CVSS 3.0 · NVD. Fix status from CNA.

Summary

In Android before 2018-01-05 on Qualcomm Snapdragon IoT, Snapdragon Mobile MDM9206, SD 625, SD 650/52, SD 835, SD 845, DDR address input validation is being improperly truncated.

Why it matters now

EPSS 0.01671 76th percentileScored 2026-11-07

Fix No fix listed No fixed version in the sources yet

SSVC decision points

Not available: CISA has not published SSVC decision points for this record.

Affected products

Vendor	Product	Affected versions	Fixed in	Status	Source
Qualcomm	Snapdragon IoT, Snapdragon Mobile	MDM9206, SD 625, SD 650/52, SD 835, SD 845	—	No fix listed	CNA

Snapdragon IoT, Snapdragon Mobile VendorQualcomm Affected MDM9206, SD 625, SD 650/52, SD 835, SD 845 Fixed in — No fix listed CNA

CPE configurations NVD · 12

CPE	Versions	Role	Vendor
cpe:2.3:o:qualcomm:mdm9206_firmware:-:::::::*	not specified by NVD	Vulnerable	Qualcomm
cpe:2.3:h:qualcomm:mdm9206:-:::::::*	not specified by NVD	Running on	Qualcomm
cpe:2.3:o:qualcomm:sd_625_firmware:-:::::::*	not specified by NVD	Vulnerable	Qualcomm
cpe:2.3:h:qualcomm:sd_625:-:::::::*	not specified by NVD	Running on	Qualcomm
cpe:2.3:o:qualcomm:sd_650_firmware:-:::::::*	not specified by NVD	Vulnerable	Qualcomm
cpe:2.3:h:qualcomm:sd_650:-:::::::*	not specified by NVD	Running on	Qualcomm
cpe:2.3:o:qualcomm:sd_652_firmware:-:::::::*	not specified by NVD	Vulnerable	Qualcomm
cpe:2.3:h:qualcomm:sd_652:-:::::::*	not specified by NVD	Running on	Qualcomm
cpe:2.3:o:qualcomm:sd_835_firmware:-:::::::*	not specified by NVD	Vulnerable	Qualcomm
cpe:2.3:h:qualcomm:sd_835:-:::::::*	not specified by NVD	Running on	Qualcomm

cpe:2.3:o:qualcomm:mdm9206_firmware:-:*:*:*:*:*:*:* Versions not specified by NVD Vulnerable ·Qualcomm
cpe:2.3:h:qualcomm:mdm9206:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Qualcomm
cpe:2.3:o:qualcomm:sd_625_firmware:-:*:*:*:*:*:*:* Versions not specified by NVD Vulnerable ·Qualcomm
cpe:2.3:h:qualcomm:sd_625:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Qualcomm
cpe:2.3:o:qualcomm:sd_650_firmware:-:*:*:*:*:*:*:* Versions not specified by NVD Vulnerable ·Qualcomm
cpe:2.3:h:qualcomm:sd_650:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Qualcomm
cpe:2.3:o:qualcomm:sd_652_firmware:-:*:*:*:*:*:*:* Versions not specified by NVD Vulnerable ·Qualcomm
cpe:2.3:h:qualcomm:sd_652:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Qualcomm
cpe:2.3:o:qualcomm:sd_835_firmware:-:*:*:*:*:*:*:* Versions not specified by NVD Vulnerable ·Qualcomm
cpe:2.3:h:qualcomm:sd_835:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Qualcomm

Show 2 more CPE

CPE	Versions	Role	Vendor
cpe:2.3:o:qualcomm:sd_845_firmware:-:::::::*	not specified by NVD	Vulnerable	Qualcomm
cpe:2.3:h:qualcomm:sd_845:-:::::::*	not specified by NVD	Running on	Qualcomm

cpe:2.3:o:qualcomm:sd_845_firmware:-:*:*:*:*:*:*:* Versions not specified by NVD Vulnerable ·Qualcomm
cpe:2.3:h:qualcomm:sd_845:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Qualcomm

Remediation

No fixed version listed by the sources yet.

Timeline

2026-10-02 Threatist record created from CVE-2017-14913
2026-10-03 Alias added: GHSA-p2cf-g38m-4mw6

References

Advisory 1

https://source.android.com/security/bulletin/2018-01-01

TI-2021-01605 Use after free in Qualcomm Snapdragon Auto, Snapdragon Compute, Snapdragon Connectivity… KEVCVSS 3.1HIGH 8.4
TI-2021-01606 Improper handling of address deregistration on failure can lead to new GPU address… KEVCVSS 3.1MEDIUM 6.2
TI-2020-03185 Buffer overflow in Qualcomm Snapdragon Auto, Snapdragon Compute, Snapdragon Consumer IOT… CVSS 3.1CRITICAL 9.8
TI-2020-09163 Improper authentication in Qualcomm Snapdragon Auto, Snapdragon Compute, Snapdragon… CVSS 3.1CRITICAL 9.1
TI-2022-14640 Improper Input Validation in MODEM CVSS 3.1CRITICAL 9.8
TI-2022-09322 Integer overflow in Qualcomm Snapdragon Auto, Snapdragon Compute, Snapdragon… CVSS 3.1CRITICAL 9.8

See all 736 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences