Track vulnerabilities like this one. Sign up free to get alerted when software you use is affected.
7.8

Qualcomm firmware token truncation weakens app data protection

CVE-2018-13908 · published 7 years ago
Summary

Certain Qualcomm firmware files (IPQ8074, MDM9150, MDM9206, MDM9607, MDM9650) can create shortened authentication tokens, which makes it easier for unauthorized users to access stored application data. This reduced access control could expose sensitive information. Apply the latest firmware updates from Qualcomm as soon as they are available to fix the issue.

What to do

The CVE record does not list a fixed version. Check the vendor's site or the advisory links below - a fix may already be released.

Affected software
VendorProductAffected versions
qualcomm ipq8074_firmware All versions
cpe:2.3:o:qualcomm:ipq8074_firmware:-:*:*:*:*:*:*:*
qualcomm mdm9150_firmware All versions
cpe:2.3:o:qualcomm:mdm9150_firmware:-:*:*:*:*:*:*:*
qualcomm mdm9206_firmware All versions
cpe:2.3:o:qualcomm:mdm9206_firmware:-:*:*:*:*:*:*:*
qualcomm mdm9607_firmware All versions
cpe:2.3:o:qualcomm:mdm9607_firmware:-:*:*:*:*:*:*:*
qualcomm mdm9650_firmware All versions
cpe:2.3:o:qualcomm:mdm9650_firmware:-:*:*:*:*:*:*:*
qualcomm mdm9655_firmware All versions
cpe:2.3:o:qualcomm:mdm9655_firmware:-:*:*:*:*:*:*:*
qualcomm msm8909w_firmware All versions
cpe:2.3:o:qualcomm:msm8909w_firmware:-:*:*:*:*:*:*:*
qualcomm msm8996au_firmware All versions
cpe:2.3:o:qualcomm:msm8996au_firmware:-:*:*:*:*:*:*:*
qualcomm qca8081_firmware All versions
cpe:2.3:o:qualcomm:qca8081_firmware:-:*:*:*:*:*:*:*
qualcomm qcs405_firmware All versions
cpe:2.3:o:qualcomm:qcs405_firmware:-:*:*:*:*:*:*:*
qualcomm qm215_firmware All versions
cpe:2.3:o:qualcomm:qm215_firmware:-:*:*:*:*:*:*:*
qualcomm sd_210_firmware All versions
cpe:2.3:o:qualcomm:sd_210_firmware:-:*:*:*:*:*:*:*
qualcomm sd_212_firmware All versions
cpe:2.3:o:qualcomm:sd_212_firmware:-:*:*:*:*:*:*:*
qualcomm sd_205_firmware All versions
cpe:2.3:o:qualcomm:sd_205_firmware:-:*:*:*:*:*:*:*
qualcomm sd_410_firmware All versions
cpe:2.3:o:qualcomm:sd_410_firmware:-:*:*:*:*:*:*:*
qualcomm sd_412_firmware All versions
cpe:2.3:o:qualcomm:sd_412_firmware:-:*:*:*:*:*:*:*
qualcomm sd_425_firmware All versions
cpe:2.3:o:qualcomm:sd_425_firmware:-:*:*:*:*:*:*:*
qualcomm sd_427_firmware All versions
cpe:2.3:o:qualcomm:sd_427_firmware:-:*:*:*:*:*:*:*
qualcomm sd_430_firmware All versions
cpe:2.3:o:qualcomm:sd_430_firmware:-:*:*:*:*:*:*:*
qualcomm sd_435_firmware All versions
cpe:2.3:o:qualcomm:sd_435_firmware:-:*:*:*:*:*:*:*
qualcomm sd_439_firmware All versions
cpe:2.3:o:qualcomm:sd_439_firmware:-:*:*:*:*:*:*:*
qualcomm sd_429_firmware All versions
cpe:2.3:o:qualcomm:sd_429_firmware:-:*:*:*:*:*:*:*
qualcomm sd_450_firmware All versions
cpe:2.3:o:qualcomm:sd_450_firmware:-:*:*:*:*:*:*:*
qualcomm sd_615_firmware All versions
cpe:2.3:o:qualcomm:sd_615_firmware:-:*:*:*:*:*:*:*
qualcomm sd_616_firmware All versions
cpe:2.3:o:qualcomm:sd_616_firmware:-:*:*:*:*:*:*:*
qualcomm qcs605_firmware All versions
cpe:2.3:o:qualcomm:qcs605_firmware:-:*:*:*:*:*:*:*
qualcomm sd_415_firmware All versions
cpe:2.3:o:qualcomm:sd_415_firmware:-:*:*:*:*:*:*:*
qualcomm sd_625_firmware All versions
cpe:2.3:o:qualcomm:sd_625_firmware:-:*:*:*:*:*:*:*
qualcomm sd_632_firmware All versions
cpe:2.3:o:qualcomm:sd_632_firmware:-:*:*:*:*:*:*:*
qualcomm sd_636_firmware All versions
cpe:2.3:o:qualcomm:sd_636_firmware:-:*:*:*:*:*:*:*
qualcomm sd_650_firmware All versions
cpe:2.3:o:qualcomm:sd_650_firmware:-:*:*:*:*:*:*:*
qualcomm sd_652_firmware All versions
cpe:2.3:o:qualcomm:sd_652_firmware:-:*:*:*:*:*:*:*
qualcomm sd_712_firmware All versions
cpe:2.3:o:qualcomm:sd_712_firmware:-:*:*:*:*:*:*:*
qualcomm sd_710_firmware All versions
cpe:2.3:o:qualcomm:sd_710_firmware:-:*:*:*:*:*:*:*
qualcomm sd_670_firmware All versions
cpe:2.3:o:qualcomm:sd_670_firmware:-:*:*:*:*:*:*:*
qualcomm sd_820_firmware All versions
cpe:2.3:o:qualcomm:sd_820_firmware:-:*:*:*:*:*:*:*
qualcomm sd_820a_firmware All versions
cpe:2.3:o:qualcomm:sd_820a_firmware:-:*:*:*:*:*:*:*
qualcomm sd_835_firmware All versions
cpe:2.3:o:qualcomm:sd_835_firmware:-:*:*:*:*:*:*:*
qualcomm sd_845_firmware All versions
cpe:2.3:o:qualcomm:sd_845_firmware:-:*:*:*:*:*:*:*
qualcomm sd_850_firmware All versions
cpe:2.3:o:qualcomm:sd_850_firmware:-:*:*:*:*:*:*:*
qualcomm sd_8cx_firmware All versions
cpe:2.3:o:qualcomm:sd_8cx_firmware:-:*:*:*:*:*:*:*
qualcomm sda660_firmware All versions
cpe:2.3:o:qualcomm:sda660_firmware:-:*:*:*:*:*:*:*
qualcomm sdm439_firmware All versions
cpe:2.3:o:qualcomm:sdm439_firmware:-:*:*:*:*:*:*:*
qualcomm sdm630_firmware All versions
cpe:2.3:o:qualcomm:sdm630_firmware:-:*:*:*:*:*:*:*
qualcomm sdm660_firmware All versions
cpe:2.3:o:qualcomm:sdm660_firmware:-:*:*:*:*:*:*:*
qualcomm snapdragon_high_med_2016_firmware All versions
cpe:2.3:o:qualcomm:snapdragon_high_med_2016_firmware:-:*:*:*:*:*:*:*
qualcomm sxr1130_firmware All versions
cpe:2.3:o:qualcomm:sxr1130_firmware:-:*:*:*:*:*:*:*
Original advisory text
Truncated access authentication token leads to weakened access control for stored secure application data in Snapdragon Auto, Snapdragon Compute, Snapdragon Connectivity, Snapdragon Consumer Electr...
Truncated access authentication token leads to weakened access control for stored secure application data in Snapdragon Auto, Snapdragon Compute, Snapdragon Connectivity, Snapdragon Consumer Electronics Connectivity, Snapdragon Consumer IOT, Snapdragon Industrial IOT, Snapdragon IoT, Snapdragon Mobile, Snapdragon Voice & Music, Snapdragon Wearables, Snapdragon Wired Infrastructure and Networking in IPQ8074, MDM9150, MDM9206, MDM9607, MDM9650, MDM9655, MSM8909W, MSM8996AU, QCA8081, QCS405, QCS605, Qualcomm 215, SD 210/SD 212/SD 205, SD 410/12, SD 425, SD 427, SD 430, SD 435, SD 439 / SD 429, SD 450, SD 615/16/SD 415, SD 625, SD 632, SD 636, SD 650/52, SD 712 / SD 710 / SD 670, SD 820, SD 820A, SD 835, SD 845 / SD 850, SD 8CX, SDA660, SDM439, SDM630, SDM660, Snapdragon_High_Med_2016, SXR1130
References
Fix within
Internet-facing 14 days
Internal At next upgrade
  • Not known to be exploited
  • Needs hands-on effort to exploit (estimated)
  • Gives an attacker full control (estimated)
Severity
7.8 High
Exploitation
<1% chance of attack within 30 days
Type
CWE-285Improper Authorization
Timeline
Published14 Jun 2019
Updated29 Oct 2026
First seen29 Sep 2026
Sources
CVE-2018-13908 · NVD
Track software like this
Free during beta