CVE-2022-25728 Buffer Over-read in MODEM
An attacker can read sensitive memory contents via a buffer over-read in the modem firmware when processing DNS responses.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2022-25728?
CVE-2022-25728 is a high-severity vulnerability in Qualcomm Ar8031 Firmware, published on 9 Feb 2023. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
Information disclosure in modem due to buffer over-read while processing response from DNS server
Which versions are affected by CVE-2022-25728?
It affects 34 products.
Products include Qualcomm Ar8031 Firmware, Qualcomm Csra6620 Firmware, Qualcomm Csra6640 Firmware, Qualcomm Mdm8207 Firmware, Qualcomm Mdm9205 Firmware, Qualcomm Mdm9206 Firmware and 28 more.
How do I fix CVE-2022-25728?
No fix has been published for CVE-2022-25728 yet. Limit exposure of the affected software until one is available.
Is CVE-2022-25728 being exploited?
There is no known exploitation of CVE-2022-25728 in the wild and no public exploit code.
Other vulnerabilities in Qualcomm Ar8031 Firmware
- CVE-2025-27038 Qualcomm Multiple Chipsets Use-After-Free
- CVE-2022-25729 Improper Input Validation in MODEM
- CVE-2022-25727 Memory corruption in Snapdragon Consumer IOT, Snapdragon Industrial IOT, Snapdragon Voice & Music
- CVE-2021-30285 Memory corruption in Snapdragon Auto, Snapdragon Compute, Snapdragon Connectivity, Snapdragon Consumer IOT, Snapdragon Industrial IOT, Snapdragon Voice & Music, Snapdragon Wired Infrastructure and Networking
- CVE-2021-30275 Integer overflow in Snapdragon Auto, Snapdragon Compute, Snapdragon Connectivity, Snapdragon Consumer IOT, Snapdragon Industrial IOT, Snapdragon Voice & Music, Snapdragon Wired Infrastructure and Networking
Sources
Also known as GHSA-3j56-76c6-9xf6.