CVE-2022-25745 Always Incorrect Control Flow Implementation in MODEM

Critical 9.8 Published 4 Apr 2023 Updated 3 Aug 2024

Memory corruption in Qualcomm Snapdragon modem firmware allows attackers to execute arbitrary code or escalate privileges via malicious CoAP messages.

Exploited in the wild: Not known
Login needed: Not needed
Attackable: Over the internet
Victim action needed: Not needed
Fix: None listed

What is CVE-2022-25745?

CVE-2022-25745 is a critical memory corruption vulnerability in Qualcomm Mdm9205 Firmware, published on 4 Apr 2023. An attacker can exploit it over the internet without logging in, with no action from the victim.

Official description

Memory corruption in modem due to improper input validation while handling the incoming CoAP message

Weakness: CWE-670

Which versions are affected by CVE-2022-25745?

It affects 5 products.

Products include Qualcomm Mdm9205 Firmware, Qualcomm Qca4004 Firmware, Qualcomm Qts110 Firmware, Qualcomm Snapdragon Wear 1300 Firmware, Qualcomm Wcd9306 Firmware.

How do I fix CVE-2022-25745?

No fix has been published for CVE-2022-25745 yet. Limit exposure of the affected software until one is available.

Upgrade to the fixed version. Memory-safe languages, compiler hardening and fuzzing prevent most new cases. More about Memory corruption.

Is CVE-2022-25745 being exploited?

There is no known exploitation of CVE-2022-25745 in the wild and no public exploit code.

All Qualcomm Mdm9205 Firmware vulnerabilities

Sources

Also known as GHSA-3288-5p9j-wphm.