CVE-2018-13901 Information disclosure in Snapdragon Auto, Snapdragon Connectivity, Snapdragon Consumer IOT, Snapdragon Industrial IOT, Snapdragon IoT, Snapdragon Mobile, Snapdragon Voice & Music, Snapdragon Wearables

Medium 5.5 Published 14 Jun 2019 Updated 5 Aug 2024

Missing Android Manifest permissions in the PCI RCS app allow sensitive information disclosure on various Qualcomm Snapdragon platforms.

Exploited in the wild: Not known
Login needed: Any signed-in user
Attackable: Local or same network only
Victim action needed: Not needed
Fix: None listed

What is CVE-2018-13901?

CVE-2018-13901 is a medium-severity vulnerability in Qualcomm Mdm9206 Firmware, published on 14 Jun 2019. It can only be exploited from the same machine or local network, with no action from the victim.

Official description

Due to missing permissions in Android Manifest file, Sensitive information disclosure issue can happen in PCI RCS app in Snapdragon Auto, Snapdragon Connectivity, Snapdragon Consumer IOT, Snapdragon Industrial IOT, Snapdragon IoT, Snapdragon Mobile, Snapdragon Voice & Music, Snapdragon Wearables in MDM9206, MDM9607, MDM9650, MSM8909W, MSM8996AU, QCA6574AU, QCS605, SD 210/SD 212/SD 205, SD 615/16/SD 415, SD 636, SD 650/52, SD 675, SD 712 / SD 710 / SD 670, SD 730, SD 820, SD 820A, SD 835, SD 845 / SD 850, SD 855, SDA660, SDM630, SDM660

Which versions are affected by CVE-2018-13901?

It affects 30 products.

Products include Qualcomm Mdm9206 Firmware, Qualcomm Mdm9607 Firmware, Qualcomm Mdm9650 Firmware, Qualcomm Msm8909w Firmware, Qualcomm Msm8996au Firmware, Qualcomm Qca6574au Firmware and 24 more.

How do I fix CVE-2018-13901?

No fix has been published for CVE-2018-13901 yet. Limit exposure of the affected software until one is available.

Is CVE-2018-13901 being exploited?

There is no known exploitation of CVE-2018-13901 in the wild and no public exploit code.

All Qualcomm Mdm9206 Firmware vulnerabilities

Sources

Also known as GHSA-283x-v98v-cchv.