Vulnerability · Published Oct 15, 2020 · Assigned by VDOO

CVE-2020-25859

Medium 6.7

In plain English

A medium-severity OS command injection in Qualcomm QCMAP. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.3% (higher than 19% of all known vulnerabilities).

Severity (CVSS NVD)6.7Medium

Exploit odds (30 days)0.3%top 80.5% of all CVEs

Exploited in the wildNo reportsnot in CISA KEV

Attack toolingNoneno public tooling known

Official description

The QCMAP_CLI utility in the Qualcomm QCMAP software suite prior to versions released in October 2020 uses a system() call without validating the input, while handling a SetGatewayUrl() request. A local attacker with shell access can pass shell metacharacters and run arbitrary commands. If QCMAP_CLI can be run via sudo or setuid, this also allows elevating privileges to root. This version of QCMAP is used in many kinds of networking devices, primarily mobile hotspots and LTE routers.

Affected products (as reported)

Vendor	Product	Versions
n/a	Qualcomm QCMAP	Fixed in October 2020

Weakness: CWE-78

References

http://vdoo.com/blog/qualcomm-qcmap-vulnerabilities x_refsource_MISC