Track vulnerabilities like this one. Sign up free to get alerted when software you use is affected.
9.8

Qualcomm Snapdragon firmware can crash during USB boot

CVE-2015-9215 · published 8 years ago
Summary

Android devices using Qualcomm Snapdragon MDM9615, MDM9625, MDM9635M or SD 810 firmware may stop working when the USB bootloader receives unexpected data. The problem results from the software not checking the input correctly, leading to a crash. Update the device to the security patch released after April 5 2018 or install the latest firmware from the manufacturer to fix it.

What to do

The CVE record does not list a fixed version. Check the vendor's site or the advisory links below - a fix may already be released.

Affected software
VendorProductAffected versions
qualcomm mdm9615_firmware All versions
cpe:2.3:o:qualcomm:mdm9615_firmware:-:*:*:*:*:*:*:*
qualcomm mdm9625_firmware All versions
cpe:2.3:o:qualcomm:mdm9625_firmware:-:*:*:*:*:*:*:*
qualcomm mdm9635m_firmware All versions
cpe:2.3:o:qualcomm:mdm9635m_firmware:-:*:*:*:*:*:*:*
qualcomm sd_810_firmware All versions
cpe:2.3:o:qualcomm:sd_810_firmware:-:*:*:*:*:*:*:*
Original advisory text
In Android before 2018-04-05 or earlier security patch level on Qualcomm Snapdragon Mobile MDM9615, MDM9625, MDM9635M, and SD 810, improper input validation can cause a null pointer dereference in ...
In Android before 2018-04-05 or earlier security patch level on Qualcomm Snapdragon Mobile MDM9615, MDM9625, MDM9635M, and SD 810, improper input validation can cause a null pointer dereference in USB bootloader find_ep() function.
References
Fix within
Internet-facing 3 days
Internal 60 days
  • Not known to be exploited
  • Can be exploited automatically (estimated)
  • Gives an attacker full control (estimated)
Severity
9.8 Critical
Exploitation
1% chance of attack within 30 days
Type
CWE-476NULL Pointer Dereference
Timeline
Published18 Apr 2018
Updated4 Nov 2026
First seen29 Sep 2026
Sources
CVE-2015-9215 · NVD
Track software like this
Free during beta