CVE-2023-21669 Buffer Over-read in WLAN HOST
An attacker can disclose sensitive information via a buffer over-read in the WLAN HOST when processing DPP action frames with invalid source addresses.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2023-21669?
CVE-2023-21669 is a high-severity vulnerability in Qualcomm Aqt1000 Firmware, published on 6 Jun 2023. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
Information Disclosure in WLAN HOST while sending DPP action frame to peer with an invalid source address.
Which versions are affected by CVE-2023-21669?
It affects 61 products.
Products include Qualcomm Aqt1000 Firmware, Qualcomm Flight Rb5 5g Platform Firmware, Qualcomm Qca6390 Firmware, Qualcomm Qca6391 Firmware, Qualcomm Qca6420 Firmware, Qualcomm Qca6421 Firmware and 55 more.
How do I fix CVE-2023-21669?
Apply the vendor's patch.
Is CVE-2023-21669 being exploited?
There is no known exploitation of CVE-2023-21669 in the wild and no public exploit code.
Other vulnerabilities in Qualcomm Aqt1000 Firmware
- CVE-2025-21479 Qualcomm Multiple Chipsets Incorrect Authorization
- CVE-2025-21480 Qualcomm Multiple Chipsets Incorrect Authorization
- CVE-2023-28562 Buffer Copy Without Checking Size of Input in QESL
- CVE-2022-40514 Buffer copy without checking size of input in WLAN Firmware
- CVE-2022-22096 Memory corruption in Snapdragon Connectivity, Snapdragon Mobile
Sources
Also known as 3346764, A-271892276, ASB-A-271892276, GHSA-4hc8-554p-pqq5.