What is CVE-2019-2317?

CVE-2019-2317 is a critical-severity vulnerability in Qualcomm Msm8905, classified under Use of Insufficiently Random Values. CVSS score: 9.8/10. Published 2020-03-05.

How severe is CVE-2019-2317?

Critical severity. CVSS v3 base score is 9.8 out of 10.

Vulnerability in Qualcomm Msm8905

CVE-2019-2317

The secret key used to make the Initial Sequence Number in the TCP SYN packet could be brute forced and therefore can be predicted in Snapdragon Auto, Snapdragon Compute, Snapdragon Consumer IOT, Snapdragon Industrial IOT, Snapdragon IoT…

EPSS: 0.007 (47.3th percentile) — read the EPSS interpretation.

CVSS v3 metric

CVSS v3 base score 9.8 (Critical). Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H.

Affected products

Qualcomm Msm8905
Qualcomm Msm8905_firmware
Qualcomm Msm8909
Qualcomm Msm8909_firmware
Qualcomm Msm8917
Qualcomm Msm8917_firmware
Qualcomm Msm8920
Qualcomm Msm8920_firmware
Qualcomm Msm8937
Qualcomm Msm8937_firmware

Weakness classification (CWE)

CWE-330 — Use of Insufficiently Random Values

References

product-security@qualcomm.com (x_refsource_CONFIRM, Vendor Advisory)

Frequently asked questions

What is CVE-2019-2317?: CVE-2019-2317 is a critical-severity vulnerability in Qualcomm Msm8905, classified under Use of Insufficiently Random Values. CVSS score: 9.8/10. Published 2020-03-05.
How severe is CVE-2019-2317?: Critical severity. CVSS v3 base score is 9.8 out of 10.