CVE-2023-33070 Improper Authentication in Automotive OS
Improper authentication in Qualcomm Automotive OS allows transient denial of service via secure IO calls.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Local or same network only
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2023-33070?
CVE-2023-33070 is a high-severity authentication bypass vulnerability in Qualcomm Aqt1000 Firmware, published on 5 Dec 2023. It can only be exploited from the same machine or local network, with no action from the victim.
Official description
Transient DOS in Automotive OS due to improper authentication to the secure IO calls.
Weakness: CWE-287
Which versions are affected by CVE-2023-33070?
It affects 102 products.
Products include Qualcomm Apq5053-Aa Firmware, Qualcomm Aqt1000 Firmware, Qualcomm Ar8031 Firmware, Qualcomm Ar8035 Firmware, Qualcomm C-V2x 9150 Firmware, Qualcomm Csra6620 Firmware and 96 more.
How do I fix CVE-2023-33070?
No fix has been published for CVE-2023-33070 yet. Limit exposure of the affected software until one is available.
Upgrade, and rotate credentials and sessions that may have been exposed. More about Authentication bypass.
Is CVE-2023-33070 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2023-33070 exists.
Other vulnerabilities in Qualcomm Aqt1000 Firmware
- CVE-2023-33079 Use of Out-of-range Pointer Offset in Audio
- CVE-2023-33087 Buffer Copy without Checking Size of Input (`Classic Buffer Overflow`) in Core
- CVE-2023-33031 Buffer Copy Without Checking Size of Input in Automotive Audio
- CVE-2023-33055 Buffer Copy Without Checking Size of Input in Audio
- CVE-2023-24850 Improper Validation of Array Index in HLOS
Sources
Also known as GHSA-9cq4-qvx2-f3hh.