CRITICAL🇵🇱 Wersja polska

CVE-2018-11922

CVSS 9.8v3.1pub. 2024-11-26upd. 2025-01-09

Wrong configuration in Touch Pal application can collect user behavior data without awareness by the user.

🤖 AI Analysis
How it works

Improper configuration of the Touch Pal application causes data regarding user behavior (e.g., keyboard interactions or other system events) to be collected implicitly. The user is not informed about this process nor does he consent to it. The vulnerability affects firmware of selected Qualcomm modem platforms.

Impact

An attacker or unauthorized third party can gain access to data about user behavior, which constitutes a serious breach of privacy and confidentiality. Depending on the scope of collected data, it is possible to disclose sensitive personal information.

Mitigation & patch

Patches available from the manufacturer should be applied in accordance with references — Qualcomm security bulletin from May 2018 (https://docs.qualcomm.com/product/publicresources/securitybulletin/may-2018-bulletin.html). It is recommended to update the firmware of devices based on vulnerable platforms.

Who is affected

Qualcomm MDM9206 Firmware, Qualcomm MDM9607 Firmware, Qualcomm MDM9640 Firmware and corresponding hardware platforms (MDM9206, MDM9607). Specific firmware versions indicated in manufacturer references.

Analysis generated by Claude AI (Anthropic) based on NVD data. Always verify with vendor.
CVSS Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

  • Qualcomm 215

    HW
    Qualcomm
    all versions

  • Qualcomm 215 Firmware

    OS
    Qualcomm
    all versions

  • Qualcomm Mdm9206

    HW
    Qualcomm
    all versions

  • Qualcomm Mdm9206 Firmware

    OS
    Qualcomm
    all versions

  • Qualcomm Mdm9607

    HW
    Qualcomm
    all versions

  • Qualcomm Mdm9607 Firmware

    OS
    Qualcomm
    all versions

  • Qualcomm Mdm9640

    HW
    Qualcomm
    all versions

  • Qualcomm Mdm9640 Firmware

    OS
    Qualcomm
    all versions

  • Qualcomm Mdm9650

    HW
    Qualcomm
    all versions

  • Qualcomm Mdm9650 Firmware

    OS
    Qualcomm
    all versions

  • Qualcomm Sd 205

    HW
    Qualcomm
    all versions

  • Qualcomm Sd 205 Firmware

    OS
    Qualcomm
    all versions

  • Qualcomm Sd 210

    HW
    Qualcomm
    all versions

  • Qualcomm Sd 210 Firmware

    OS
    Qualcomm
    all versions

  • Qualcomm Sd 212

    HW
    Qualcomm
    all versions

  • Qualcomm Sd 212 Firmware

    OS
    Qualcomm
    all versions

  • Qualcomm Sd 425

    HW
    Qualcomm
    all versions

  • Qualcomm Sd 425 Firmware

    OS
    Qualcomm
    all versions

  • Qualcomm Sd 427

    HW
    Qualcomm
    all versions

  • Qualcomm Sd 427 Firmware

    OS
    Qualcomm
    all versions

  • Qualcomm Sd 429

    HW
    Qualcomm
    all versions

  • Qualcomm Sd 429 Firmware

    OS
    Qualcomm
    all versions

  • Qualcomm Sd 430

    HW
    Qualcomm
    all versions

  • Qualcomm Sd 430 Firmware

    OS
    Qualcomm
    all versions

  • Qualcomm Sd 435

    HW
    Qualcomm
    all versions

  • Qualcomm Sd 435 Firmware

    OS
    Qualcomm
    all versions

  • Qualcomm Sd 439

    HW
    Qualcomm
    all versions

  • Qualcomm Sd 439 Firmware

    OS
    Qualcomm
    all versions

  • Qualcomm Sd 450

    HW
    Qualcomm
    all versions

  • Qualcomm Sd 450 Firmware

    OS
    Qualcomm
    all versions
🔵
CHECK WITH VENDOR
No clear patch data available. Check vendor references.
CWE
References

Related vulnerabilities

CVE-2017-11076CRITICAL9.8PL ✓same product

Qualcomm: Nieprawidłowy dostęp do pamięci przy dekodowaniu VP9 (sprzętowe)

CVE-2017-17772CRITICAL9.8PL ✓same product

Qualcomm SD 450/625/820 — odczyt poza granicami bufora w obsłudze ramek 802.11

CVE-2023-43551CRITICAL9.1PL ✓same product

Pominięcie uwierzytelnienia w sieciach LTE w modemach Qualcomm

CVE-2023-33030CRITICAL9.3PL ✓same product

Memory corruption w HLOS podczas obsługi PlayReady w chipsetach Qualcomm

CVE-2023-22388CRITICAL9.8PL ✓same product

Uszkodzenie pamięci w procesorze połączeń Qualcomm — podatność krytyczna