CVE-2019-2317
Critical
Description
The secret key used to make the Initial Sequence Number in the TCP SYN packet could be brute forced and therefore can be predicted in Snapdragon Auto, Snapdragon Compute, Snapdragon Consumer IOT, Snapdragon Industrial IOT, Snapdragon IoT, Snapdragon Mobile, Snapdragon Voice & Music, Snapdragon Wearables in MSM8905, MSM8909, MSM8917, MSM8920, MSM8937, MSM8940, MSM8953, Nicobar, QCM2150, QM215, SC8180X, SDM429, SDM439, SDM450, SDM632, SDX24, SDX55, SM6150, SM7150, SM8150
SeverityCritical
CVSS9.8
Exploit probability—
Product
Qualcomm Msm8905 Firmware
PublishedMar 5, 2020
First seenMar 5, 2020
How to fix
Sources list no fixed version or patch link for this vulnerability.
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| qualcomm msm8905_firmware | No range specified | — |
| qualcomm msm8909_firmware | No range specified | — |
| qualcomm msm8917_firmware | No range specified | — |
| qualcomm msm8920_firmware | No range specified | — |
| qualcomm msm8937_firmware | No range specified | — |
| qualcomm msm8940_firmware | No range specified | — |
| qualcomm msm8953_firmware | No range specified | — |
| qualcomm nicobar_firmware | No range specified | — |
| qualcomm qcm2150_firmware | No range specified | — |
| qualcomm qm215_firmware | No range specified | — |
| qualcomm sc8180x_firmware | No range specified | — |
| qualcomm sdm429_firmware | No range specified | — |
| qualcomm sdm439_firmware | No range specified | — |
| qualcomm sdm450_firmware | No range specified | — |
| qualcomm sdm632_firmware | No range specified | — |
| qualcomm sdx24_firmware | No range specified | — |
| qualcomm sdx55_firmware | No range specified | — |
| qualcomm sm6150_firmware | No range specified | — |
| qualcomm sm7150_firmware | No range specified | — |
| qualcomm sm8150_firmware | No range specified | — |
Check your version
Choose the product and enter the version you run to see whether it falls in the affected range.
In the Intelligence 360 plan
Attack Surface Management
See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.