CVE-2018-11277

mediumPriorität · verfolgen · 31EPSS 0.002 · 6. PerzentilEUUS

grimoire priorityP3 · Track

Exploitable?

—

no known exploitation

Likely / severe?

0.17% (6th) EPSS

CVSS 4.6 · medium

Is it mine?

21 products

Prüfe deine Angriffsfläche

Who says so?

3 sources

cnnvd · enisa_euvd · nvd

EPSS · bewertet 2026-10-27

In Snapdragon (Automobile, Mobile, Wear) in version MSM8909W, MSM8996AU, SD 210/SD 212/SD 205, SD 430, SD 450, SD 615/16/SD 415, SD 617, SD 625, SD 650/52, SD 810, SD 820, SD 820A, SD 835, SD 845, SDA660, the com.qualcomm.embms is a vendor package deployed in the system image which has an inadequate permission level and allows any application installed from Play Store to request this permission at install-time. The system application interfaces with the Radio Interface Layer leading to potential access control issue.

cvss

Technischer Schweregrad, 0–10. Eine Zeile je Quelle.

7.8

010

Basiswert 0–10 · höher = schwerwiegender · Vektor überfahren zum Auflösen⚠ Quellen uneinig · medium–high · 4.6–7.8

v2.04.6mediumAV:L/AC:L/Au:N/C:P/I:P/A:Pprimary · NVD / NIST USAusnutzbarkeit 3.9 · Auswirkung 6.4

v3.07.8highCVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:Hprimary · NVD / NIST USAusnutzbarkeit 1.8 · Auswirkung 5.9

v3.07.1highCVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H/E:Usecondary · CVSS-BT (t0sche)

schwächen

Die CWE-Schwächeklassen, zu denen dies gehört.

CWE-732USprimär

betroffene Produkte (21)

Betroffene Produkte und Versionsbereiche.

Qualcomm, Inc. Snapdragon Automobile, Snapdragon Mobile, Snapdragon Wear≤ MSM8909W, MSM8996AU, SD 210/SD 212/SD 205, SD 430, SD 450, SD 615/16/SD 415, SD 617, SD 625, SD 650/52, SD 810, SD 820, SD 820A, SD 835, SD 845, SDA660enisa_euvdEU
qualcomm msm8909w firmwarealle VersionennvdUScpe:2.3:o:qualcomm:msm8909w_firmware:*:*:*:*:*:*:*:*
qualcomm msm8996au firmwarealle VersionennvdUScpe:2.3:o:qualcomm:msm8996au_firmware:*:*:*:*:*:*:*:*
qualcomm sd205 firmwarealle VersionennvdUScpe:2.3:o:qualcomm:sd205_firmware:*:*:*:*:*:*:*:*
qualcomm sd210 firmwarealle VersionennvdUScpe:2.3:o:qualcomm:sd210_firmware:*:*:*:*:*:*:*:*
qualcomm sd212 firmwarealle VersionennvdUScpe:2.3:o:qualcomm:sd212_firmware:*:*:*:*:*:*:*:*
qualcomm sd415 firmwarealle VersionennvdUScpe:2.3:o:qualcomm:sd415_firmware:*:*:*:*:*:*:*:*
qualcomm sd430 firmwarealle VersionennvdUScpe:2.3:o:qualcomm:sd430_firmware:*:*:*:*:*:*:*:*
qualcomm sd450 firmwarealle VersionennvdUScpe:2.3:o:qualcomm:sd450_firmware:*:*:*:*:*:*:*:*
qualcomm sd615 firmwarealle VersionennvdUScpe:2.3:o:qualcomm:sd615_firmware:*:*:*:*:*:*:*:*
qualcomm sd616 firmwarealle VersionennvdUScpe:2.3:o:qualcomm:sd616_firmware:*:*:*:*:*:*:*:*
qualcomm sd617 firmwarealle VersionennvdUScpe:2.3:o:qualcomm:sd617_firmware:*:*:*:*:*:*:*:*
qualcomm sd625 firmwarealle VersionennvdUScpe:2.3:o:qualcomm:sd625_firmware:*:*:*:*:*:*:*:*
qualcomm sd650 firmwarealle VersionennvdUScpe:2.3:o:qualcomm:sd650_firmware:*:*:*:*:*:*:*:*
qualcomm sd652 firmwarealle VersionennvdUScpe:2.3:o:qualcomm:sd652_firmware:*:*:*:*:*:*:*:*
qualcomm sd810 firmwarealle VersionennvdUScpe:2.3:o:qualcomm:sd810_firmware:*:*:*:*:*:*:*:*
qualcomm sd820 firmwarealle VersionennvdUScpe:2.3:o:qualcomm:sd820_firmware:*:*:*:*:*:*:*:*
qualcomm sd820a firmwarealle VersionennvdUScpe:2.3:o:qualcomm:sd820a_firmware:*:*:*:*:*:*:*:*
qualcomm sd835 firmwarealle VersionennvdUScpe:2.3:o:qualcomm:sd835_firmware:*:*:*:*:*:*:*:*
qualcomm sd845 firmwarealle VersionennvdUScpe:2.3:o:qualcomm:sd845_firmware:*:*:*:*:*:*:*:*

20 von 21 angezeigt

auch bekannt als (3)

Weitere Namen und Kennungen dieser Entität.

quellen

Welche Quellen diesen Datensatz belegen und wann.

cnnvd enisa_euvd nvd NVD CVE.org MITRE

veröffentlicht 2018-09-20geändert 2026-06-17

verwandt (1,935)

Verwandte Einträge.

ID	Schweregrad	EPSS	ausnutzbar	veröffentlicht
CVE-2022-22960US	high7.8OT kritisch	35.5% (98th)	KEV	2022-04-13
VMware Workspace ONE Access, Identity Manager and vRealize Automation contain a privilege escalation vulnerability due to improper permissions in support scripts. A malicious actor…
CVE-2021-23874US	high7.8OT kritisch	1.03% (63rd)	KEV	2021-02-10
Arbitrary Process Execution vulnerability in McAfee Total Protection (MTP) prior to 16.0.30 allows a local user to gain elevated privileges and execute arbitrary code bypassing MTP…
CVE-2019-15752US	high7.8OT kritisch	48.6% (99th)	KEV	2019-08-28
Docker Desktop Community Edition before 2.1.0.1 allows local users to gain privileges by placing a Trojan horse docker-credential-wincred.exe file in %PROGRAMDATA%\DockerDesktop\ve…
CVE-2018-13374US	medium4.3OT kritisch	38.1% (99th)	KEV	2019-01-22
A Improper Access Control in Fortinet FortiOS 6.0.2, 5.6.7 and before, FortiADC 6.1.0, 6.0.0 to 6.0.1, 5.4.0 to 5.4.4 allows attacker to obtain the LDAP server login credentials co…
CVE-2021-25646US	high8.8	99.1% (100th)	Exploit	2021-01-29
Apache Druid includes the ability to execute user-provided JavaScript code embedded in various types of requests. This functionality is intended for use in high-trust environments,…

+1930 weitere

Referenzen (3)

Externe Belege — Patches, Meldungen, Analysen.

scry

Angreifer nutzen Schwachstellen wie diese gegen im Internet exponierte Dienste aus. Sehen Sie mit einem kostenlosen Passiv-Scan, was exponiert ist.

Kostenloser Scan