vulnwire
9.3crit

CVE-2018-11284

Spoofed SMS can be used to send a large number of messages to the device which will in turn initiate a flood of registration updates with t…

Published 7 y ago · modified 4 mo ago · JSON

CVSS
9.3
v3.0 · NVD
CISA KEV
No
not known exploited
EPSS
0.5%
percentile 46%
Public exploits
0
none known

Spoofed SMS can be used to send a large number of messages to the device which will in turn initiate a flood of registration updates with the server in snapdragon mobile and snapdragon wear in versions MDM9206, MDM9607, MDM9650, SD 210/SD 212/SD 205, SD 625, SD 636, SDA660, SDM630, SDM660, SDX20

Exploit prediction (EPSS)

0.55% probability of exploitation in the next 30 days, higher than 46% of all scored CVEs.

CVSS scores

Assigned byVersionScoreVector
NVD3.09.3CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:L/A:H
NVD2.08.5AV:N/AC:L/Au:N/C:N/I:P/A:C

Affected products

  • Qualcomm, Inc. Snapdragon Mobile, Snapdragon Wear

References

  • qualcomm.com /company/product-security/bulletins · x_refsource_CONFIRM, x_transferred

Sources

vulnwire keeps one entry per vulnerability: the CVE id wins, then GHSA; records that alias each other are merged. Machine-readable: JSON.