u'Lack of handling unexpected control messages while encryption was in progress can…
Priority LOW 33Published · Updated
Key facts
- Attack vector
- Network
- Privileges required
- None
- User interaction
- None
- Attack complexity
- Low
- Impact type
- —
- Confidentiality · integrity · availability
- None · None · High
- Fix status
- No fix listed
Attack profile from CVSS 3.1 · NVD. Fix status from CNA.
Summary
u'Lack of handling unexpected control messages while encryption was in progress can terminate the connection and thus leading to a DoS' in Snapdragon Auto, Snapdragon Connectivity, Snapdragon Consumer Electronics Connectivity, Snapdragon Consumer IOT, Snapdragon Industrial IOT, Snapdragon Mobile, Snapdragon Voice & Music, Snapdragon Wearables in APQ8053, APQ8076, MDM9640, MDM9650, MSM8905, MSM8917, MSM8937, MSM8940, MSM8953, QCA6174A, QCA9886, QCM2150, QM215, SDM429, SDM439, SDM450, SDM632
Why it matters now
EPSS 0.00412 35th percentileScored 2026-11-07
Fix No fix listed No fixed version in the sources yet
SSVC decision points
Not available: CISA has not published SSVC decision points for this record.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| Qualcomm | Snapdragon Auto, Snapdragon Connectivity, Snapdragon Consumer Electronics Connectivity, Snapdragon Consumer IOT, Snapdragon Industrial IOT, Snapdragon Mobile, Snapdragon Voice & Music, Snapdragon Wearables | APQ8053, APQ8076, MDM9640, MDM9650, MSM8905, MSM8917, MSM8937, MSM8940, MSM8953, QCA6174A, QCA9886, QCM2150, QM215, SDM429, SDM439, SDM450, SDM632 | — | No fix listed | CNA |
- Snapdragon Auto, Snapdragon Connectivity, Snapdragon Consumer Electronics Connectivity, Snapdragon Consumer IOT, Snapdragon Industrial IOT, Snapdragon Mobile, Snapdragon Voice & Music, Snapdragon Wearables VendorQualcomm Affected APQ8053, APQ8076, MDM9640, MDM9650, MSM8905, MSM8917, MSM8937, MSM8940, MSM8953, QCA6174A, QCA9886, QCM2150, QM215, SDM429, SDM439, SDM450, SDM632 Fixed in — No fix listed CNA
CPE configurations NVD · 34
| CPE | Versions | Role | Vendor |
|---|---|---|---|
| cpe:2.3:o:qualcomm:apq8053_firmware:-:*:*:*:*:*:*:* | not specified by NVD | Vulnerable | Qualcomm |
| cpe:2.3:h:qualcomm:apq8053:-:*:*:*:*:*:*:* | not specified by NVD | Running on | Qualcomm |
| cpe:2.3:o:qualcomm:apq8076_firmware:-:*:*:*:*:*:*:* | not specified by NVD | Vulnerable | Qualcomm |
| cpe:2.3:h:qualcomm:apq8076:-:*:*:*:*:*:*:* | not specified by NVD | Running on | Qualcomm |
| cpe:2.3:o:qualcomm:mdm9640_firmware:-:*:*:*:*:*:*:* | not specified by NVD | Vulnerable | Qualcomm |
| cpe:2.3:h:qualcomm:mdm9640:-:*:*:*:*:*:*:* | not specified by NVD | Running on | Qualcomm |
| cpe:2.3:o:qualcomm:mdm9650_firmware:-:*:*:*:*:*:*:* | not specified by NVD | Vulnerable | Qualcomm |
| cpe:2.3:h:qualcomm:mdm9650:-:*:*:*:*:*:*:* | not specified by NVD | Running on | Qualcomm |
| cpe:2.3:o:qualcomm:msm8905_firmware:-:*:*:*:*:*:*:* | not specified by NVD | Vulnerable | Qualcomm |
| cpe:2.3:h:qualcomm:msm8905:-:*:*:*:*:*:*:* | not specified by NVD | Running on | Qualcomm |
- cpe:2.3:o:qualcomm:apq8053_firmware:-:*:*:*:*:*:*:* Versions not specified by NVD Vulnerable ·Qualcomm
- cpe:2.3:h:qualcomm:apq8053:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Qualcomm
- cpe:2.3:o:qualcomm:apq8076_firmware:-:*:*:*:*:*:*:* Versions not specified by NVD Vulnerable ·Qualcomm
- cpe:2.3:h:qualcomm:apq8076:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Qualcomm
- cpe:2.3:o:qualcomm:mdm9640_firmware:-:*:*:*:*:*:*:* Versions not specified by NVD Vulnerable ·Qualcomm
- cpe:2.3:h:qualcomm:mdm9640:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Qualcomm
- cpe:2.3:o:qualcomm:mdm9650_firmware:-:*:*:*:*:*:*:* Versions not specified by NVD Vulnerable ·Qualcomm
- cpe:2.3:h:qualcomm:mdm9650:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Qualcomm
- cpe:2.3:o:qualcomm:msm8905_firmware:-:*:*:*:*:*:*:* Versions not specified by NVD Vulnerable ·Qualcomm
- cpe:2.3:h:qualcomm:msm8905:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Qualcomm
Show 24 more CPE
| CPE | Versions | Role | Vendor |
|---|---|---|---|
| cpe:2.3:o:qualcomm:msm8917_firmware:-:*:*:*:*:*:*:* | not specified by NVD | Vulnerable | Qualcomm |
| cpe:2.3:h:qualcomm:msm8917:-:*:*:*:*:*:*:* | not specified by NVD | Running on | Qualcomm |
| cpe:2.3:o:qualcomm:msm8937_firmware:-:*:*:*:*:*:*:* | not specified by NVD | Vulnerable | Qualcomm |
| cpe:2.3:h:qualcomm:msm8937:-:*:*:*:*:*:*:* | not specified by NVD | Running on | Qualcomm |
| cpe:2.3:o:qualcomm:msm8940_firmware:-:*:*:*:*:*:*:* | not specified by NVD | Vulnerable | Qualcomm |
| cpe:2.3:h:qualcomm:msm8940:-:*:*:*:*:*:*:* | not specified by NVD | Running on | Qualcomm |
| cpe:2.3:o:qualcomm:msm8953_firmware:-:*:*:*:*:*:*:* | not specified by NVD | Vulnerable | Qualcomm |
| cpe:2.3:h:qualcomm:msm8953:-:*:*:*:*:*:*:* | not specified by NVD | Running on | Qualcomm |
| cpe:2.3:o:qualcomm:qca6174a_firmware:-:*:*:*:*:*:*:* | not specified by NVD | Vulnerable | Qualcomm |
| cpe:2.3:h:qualcomm:qca6174a:-:*:*:*:*:*:*:* | not specified by NVD | Running on | Qualcomm |
| cpe:2.3:o:qualcomm:qca9886_firmware:-:*:*:*:*:*:*:* | not specified by NVD | Vulnerable | Qualcomm |
| cpe:2.3:h:qualcomm:qca9886:-:*:*:*:*:*:*:* | not specified by NVD | Running on | Qualcomm |
| cpe:2.3:o:qualcomm:qcm2150_firmware:-:*:*:*:*:*:*:* | not specified by NVD | Vulnerable | Qualcomm |
| cpe:2.3:h:qualcomm:qcm2150:-:*:*:*:*:*:*:* | not specified by NVD | Running on | Qualcomm |
| cpe:2.3:o:qualcomm:qm215_firmware:-:*:*:*:*:*:*:* | not specified by NVD | Vulnerable | Qualcomm |
| cpe:2.3:h:qualcomm:qm215:-:*:*:*:*:*:*:* | not specified by NVD | Running on | Qualcomm |
| cpe:2.3:o:qualcomm:sdm429_firmware:-:*:*:*:*:*:*:* | not specified by NVD | Vulnerable | Qualcomm |
| cpe:2.3:h:qualcomm:sdm429:-:*:*:*:*:*:*:* | not specified by NVD | Running on | Qualcomm |
| cpe:2.3:o:qualcomm:sdm439_firmware:-:*:*:*:*:*:*:* | not specified by NVD | Vulnerable | Qualcomm |
| cpe:2.3:h:qualcomm:sdm439:-:*:*:*:*:*:*:* | not specified by NVD | Running on | Qualcomm |
| cpe:2.3:o:qualcomm:sdm450_firmware:-:*:*:*:*:*:*:* | not specified by NVD | Vulnerable | Qualcomm |
| cpe:2.3:h:qualcomm:sdm450:-:*:*:*:*:*:*:* | not specified by NVD | Running on | Qualcomm |
| cpe:2.3:o:qualcomm:sdm632_firmware:-:*:*:*:*:*:*:* | not specified by NVD | Vulnerable | Qualcomm |
| cpe:2.3:h:qualcomm:sdm632:-:*:*:*:*:*:*:* | not specified by NVD | Running on | Qualcomm |
- cpe:2.3:o:qualcomm:msm8917_firmware:-:*:*:*:*:*:*:* Versions not specified by NVD Vulnerable ·Qualcomm
- cpe:2.3:h:qualcomm:msm8917:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Qualcomm
- cpe:2.3:o:qualcomm:msm8937_firmware:-:*:*:*:*:*:*:* Versions not specified by NVD Vulnerable ·Qualcomm
- cpe:2.3:h:qualcomm:msm8937:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Qualcomm
- cpe:2.3:o:qualcomm:msm8940_firmware:-:*:*:*:*:*:*:* Versions not specified by NVD Vulnerable ·Qualcomm
- cpe:2.3:h:qualcomm:msm8940:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Qualcomm
- cpe:2.3:o:qualcomm:msm8953_firmware:-:*:*:*:*:*:*:* Versions not specified by NVD Vulnerable ·Qualcomm
- cpe:2.3:h:qualcomm:msm8953:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Qualcomm
- cpe:2.3:o:qualcomm:qca6174a_firmware:-:*:*:*:*:*:*:* Versions not specified by NVD Vulnerable ·Qualcomm
- cpe:2.3:h:qualcomm:qca6174a:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Qualcomm
- cpe:2.3:o:qualcomm:qca9886_firmware:-:*:*:*:*:*:*:* Versions not specified by NVD Vulnerable ·Qualcomm
- cpe:2.3:h:qualcomm:qca9886:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Qualcomm
- cpe:2.3:o:qualcomm:qcm2150_firmware:-:*:*:*:*:*:*:* Versions not specified by NVD Vulnerable ·Qualcomm
- cpe:2.3:h:qualcomm:qcm2150:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Qualcomm
- cpe:2.3:o:qualcomm:qm215_firmware:-:*:*:*:*:*:*:* Versions not specified by NVD Vulnerable ·Qualcomm
- cpe:2.3:h:qualcomm:qm215:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Qualcomm
- cpe:2.3:o:qualcomm:sdm429_firmware:-:*:*:*:*:*:*:* Versions not specified by NVD Vulnerable ·Qualcomm
- cpe:2.3:h:qualcomm:sdm429:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Qualcomm
- cpe:2.3:o:qualcomm:sdm439_firmware:-:*:*:*:*:*:*:* Versions not specified by NVD Vulnerable ·Qualcomm
- cpe:2.3:h:qualcomm:sdm439:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Qualcomm
- cpe:2.3:o:qualcomm:sdm450_firmware:-:*:*:*:*:*:*:* Versions not specified by NVD Vulnerable ·Qualcomm
- cpe:2.3:h:qualcomm:sdm450:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Qualcomm
- cpe:2.3:o:qualcomm:sdm632_firmware:-:*:*:*:*:*:*:* Versions not specified by NVD Vulnerable ·Qualcomm
- cpe:2.3:h:qualcomm:sdm632:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Qualcomm
Remediation
No fixed version listed by the sources yet.
Timeline
- 2026-10-02 Threatist record created from CVE-2020-11157
- 2026-10-03 Alias added: GHSA-gf78-g9ww-32j9
More Qualcomm Apq8053 Firmware vulnerabilities
- TI-2022-06419 Use after free in Qualcomm Snapdragon Auto, Snapdragon Compute, Snapdragon Connectivity… KEVCVSS 3.1HIGH 8.4
- TI-2021-01605 Use after free in Qualcomm Snapdragon Auto, Snapdragon Compute, Snapdragon Connectivity… KEVCVSS 3.1HIGH 8.4
- TI-2020-09124 Improper input validation in Qualcomm Snapdragon Auto, Snapdragon Compute, Snapdragon… KEVCVSS 3.1HIGH 7.8
- TI-2021-01606 Improper handling of address deregistration on failure can lead to new GPU address… KEVCVSS 3.1MEDIUM 6.2
- TI-2020-03185 Buffer overflow in Qualcomm Snapdragon Auto, Snapdragon Compute, Snapdragon Consumer IOT… CVSS 3.1CRITICAL 9.8
- TI-2020-09127 Improper authentication in Qualcomm Snapdragon Auto, Snapdragon Compute, Snapdragon… CVSS 3.1CRITICAL 9.8
Sources
- CVE-2020-11157 · CVE Program
- CVE-2020-11157 · NVD
- FIRST EPSS
- GHSA-gf78-g9ww-32j9 · GitHub Advisory Database · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences