CVE-2025-27029 - Vulnerability Details - OpenCVE

Transient DOS while processing the tone measurement response buffer when the response buffer is out of range.

No CVSS v4.0

Attack Vector Network

Attack Complexity Low

Privileges Required None

Scope Unchanged

Confidentiality Impact None

Integrity Impact None

Availability Impact High

User Interaction None

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

Exploitation none

Automatable yes

Technical Impact partial

No data.

No data.

No data.

References

Link	Providers
https://docs.qualcomm.com/product/publicresources/securitybulletin/june-2025-bulletin.html

History

Tue, 03 Jun 2025 15:15:00 +0000

Type	Values Removed	Values Added
Metrics		ssvc `{'options': {'Automatable': 'yes', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}`

Tue, 03 Jun 2025 06:00:00 +0000

Type	Values Removed	Values Added
Description		Transient DOS while processing the tone measurement response buffer when the response buffer is out of range.
Title		Buffer Over-read in WLAN HAL
Weaknesses		CWE-126
References		https://docs.qualcomm.com/product/publicresources/securitybulletin/june-2025-bulletin.html
Metrics		cvssV3_1 `{'score': 7.5, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H'}`

MITRE

Status: PUBLISHED

Assigner: qualcomm

Published: 2025-06-03T05:53:04.451Z

Updated: 2025-06-03T14:49:01.250Z

Reserved: 2025-02-18T09:19:46.882Z

Link: CVE-2025-27029

Vulnrichment

Updated: 2025-06-03T14:48:58.411Z

NVD

Status : Awaiting Analysis

Published: 2025-06-03T06:15:26.777

Modified: 2025-06-04T14:54:33.783

Link: CVE-2025-27029

Redhat

No data.

{"dataType": "CVE_RECORD", "dataVersion": "5.1", "cveMetadata": {"cveId": "CVE-2025-27029", "assignerOrgId": "2cfc7d3e-20d3-47ac-8db7-1b7285aff15f", "state": "PUBLISHED", "assignerShortName": "qualcomm", "dateReserved": "2025-02-18T09:19:46.882Z", "datePublished": "2025-06-03T05:53:04.451Z", "dateUpdated": "2025-06-03T14:49:01.250Z"}, "containers": {"cna": {"affected": [{"defaultStatus": "unaffected", "platforms": ["Snapdragon Auto", "Snapdragon Industrial IOT", "Snapdragon MC", "Snapdragon Mobile", "Snapdragon Wired Infrastructure and Networking"], "product": "Snapdragon", "vendor": "Qualcomm, Inc.", "versions": [{"status": "affected", "version": "FastConnect 7800"}, {"status": "affected", "version": "Immersive Home 3210 Platform"}, {"status": "affected", "version": "Immersive Home 326 Platform"}, {"status": "affected", "version": "IPQ5300"}, {"status": "affected", "version": "IPQ5302"}, {"status": "affected", "version": "IPQ5312"}, {"status": "affected", "version": "IPQ5332"}, {"status": "affected", "version": "IPQ5424"}, {"status": "affected", "version": "IPQ9008"}, {"status": "affected", "version": "IPQ9048"}, {"status": "affected", "version": "IPQ9554"}, {"status": "affected", "version": "IPQ9570"}, {"status": "affected", "version": "IPQ9574"}, {"status": "affected", "version": "QCA0000"}, {"status": "affected", "version": "QCA8075"}, {"status": "affected", "version": "QCA8080"}, {"status": "affected", "version": "QCA8081"}, {"status": "affected", "version": "QCA8082"}, {"status": "affected", "version": "QCA8084"}, {"status": "affected", "version": "QCA8085"}, {"status": "affected", "version": "QCA8101"}, {"status": "affected", "version": "QCA8102"}, {"status": "affected", "version": "QCA8111"}, {"status": "affected", "version": "QCA8112"}, {"status": "affected", "version": "QCA8384"}, {"status": "affected", "version": "QCA8385"}, {"status": "affected", "version": "QCA8386"}, {"status": "affected", "version": "QCF8000"}, {"status": "affected", "version": "QCF8001"}, {"status": "affected", "version": "QCN5124"}, {"status": "affected", "version": "QCN5224"}, {"status": "affected", "version": "QCN6402"}, {"status": "affected", "version": "QCN6412"}, {"status": "affected", "version": "QCN6422"}, {"status": "affected", "version": "QCN6432"}, {"status": "affected", "version": "QCN9000"}, {"status": "affected", "version": "QCN9012"}, {"status": "affected", "version": "QCN9024"}, {"status": "affected", "version": "QCN9074"}, {"status": "affected", "version": "QCN9160"}, {"status": "affected", "version": "QCN9274"}, {"status": "affected", "version": "QMP1000"}, {"status": "affected", "version": "QXM8083"}, {"status": "affected", "version": "SM6650"}, {"status": "affected", "version": "SM6650P"}, {"status": "affected", "version": "SM7635"}, {"status": "affected", "version": "SM8735"}, {"status": "affected", "version": "SM8750"}, {"status": "affected", "version": "SM8750P"}, {"status": "affected", "version": "Snapdragon 8 Gen 3 Mobile Platform"}, {"status": "affected", "version": "WCD9378"}, {"status": "affected", "version": "WCD9390"}, {"status": "affected", "version": "WCD9395"}, {"status": "affected", "version": "WCN6450"}, {"status": "affected", "version": "WCN6650"}, {"status": "affected", "version": "WCN6755"}, {"status": "affected", "version": "WCN7750"}, {"status": "affected", "version": "WCN7860"}, {"status": "affected", "version": "WCN7861"}, {"status": "affected", "version": "WCN7880"}, {"status": "affected", "version": "WCN7881"}, {"status": "affected", "version": "WSA8830"}, {"status": "affected", "version": "WSA8832"}, {"status": "affected", "version": "WSA8835"}, {"status": "affected", "version": "WSA8840"}, {"status": "affected", "version": "WSA8845"}, {"status": "affected", "version": "WSA8845H"}]}], "descriptions": [{"lang": "en", "value": "Transient DOS while processing the tone measurement response buffer when the response buffer is out of range."}], "metrics": [{"cvssV3_1": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 7.5, "baseSeverity": "HIGH", "confidentialityImpact": "NONE", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "version": "3.1"}, "format": "CVSS", "scenarios": [{"lang": "en", "value": "GENERAL"}]}], "problemTypes": [{"descriptions": [{"cweId": "CWE-126", "description": "CWE-126 Buffer Over-read", "lang": "en", "type": "CWE"}]}], "providerMetadata": {"orgId": "2cfc7d3e-20d3-47ac-8db7-1b7285aff15f", "shortName": "qualcomm", "dateUpdated": "2025-06-03T05:53:04.451Z"}, "references": [{"url": "https://docs.qualcomm.com/product/publicresources/securitybulletin/june-2025-bulletin.html"}], "title": "Buffer Over-read in WLAN HAL"}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2025-06-03T14:48:53.898973Z", "id": "CVE-2025-27029", "options": [{"Exploitation": "none"}, {"Automatable": "yes"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2025-06-03T14:49:01.250Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2025-27029", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "yes"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2025-06-03T14:48:53.898973Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2025-06-03T14:48:58.411Z"}}], "cna": {"title": "Buffer Over-read in WLAN HAL", "metrics": [{"format": "CVSS", "cvssV3_1": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 7.5, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "NONE", "confidentialityImpact": "NONE"}, "scenarios": [{"lang": "en", "value": "GENERAL"}]}], "affected": [{"vendor": "Qualcomm, Inc.", "product": "Snapdragon", "versions": [{"status": "affected", "version": "FastConnect 7800"}, {"status": "affected", "version": "Immersive Home 3210 Platform"}, {"status": "affected", "version": "Immersive Home 326 Platform"}, {"status": "affected", "version": "IPQ5300"}, {"status": "affected", "version": "IPQ5302"}, {"status": "affected", "version": "IPQ5312"}, {"status": "affected", "version": "IPQ5332"}, {"status": "affected", "version": "IPQ5424"}, {"status": "affected", "version": "IPQ9008"}, {"status": "affected", "version": "IPQ9048"}, {"status": "affected", "version": "IPQ9554"}, {"status": "affected", "version": "IPQ9570"}, {"status": "affected", "version": "IPQ9574"}, {"status": "affected", "version": "QCA0000"}, {"status": "affected", "version": "QCA8075"}, {"status": "affected", "version": "QCA8080"}, {"status": "affected", "version": "QCA8081"}, {"status": "affected", "version": "QCA8082"}, {"status": "affected", "version": "QCA8084"}, {"status": "affected", "version": "QCA8085"}, {"status": "affected", "version": "QCA8101"}, {"status": "affected", "version": "QCA8102"}, {"status": "affected", "version": "QCA8111"}, {"status": "affected", "version": "QCA8112"}, {"status": "affected", "version": "QCA8384"}, {"status": "affected", "version": "QCA8385"}, {"status": "affected", "version": "QCA8386"}, {"status": "affected", "version": "QCF8000"}, {"status": "affected", "version": "QCF8001"}, {"status": "affected", "version": "QCN5124"}, {"status": "affected", "version": "QCN5224"}, {"status": "affected", "version": "QCN6402"}, {"status": "affected", "version": "QCN6412"}, {"status": "affected", "version": "QCN6422"}, {"status": "affected", "version": "QCN6432"}, {"status": "affected", "version": "QCN9000"}, {"status": "affected", "version": "QCN9012"}, {"status": "affected", "version": "QCN9024"}, {"status": "affected", "version": "QCN9074"}, {"status": "affected", "version": "QCN9160"}, {"status": "affected", "version": "QCN9274"}, {"status": "affected", "version": "QMP1000"}, {"status": "affected", "version": "QXM8083"}, {"status": "affected", "version": "SM6650"}, {"status": "affected", "version": "SM6650P"}, {"status": "affected", "version": "SM7635"}, {"status": "affected", "version": "SM8735"}, {"status": "affected", "version": "SM8750"}, {"status": "affected", "version": "SM8750P"}, {"status": "affected", "version": "Snapdragon 8 Gen 3 Mobile Platform"}, {"status": "affected", "version": "WCD9378"}, {"status": "affected", "version": "WCD9390"}, {"status": "affected", "version": "WCD9395"}, {"status": "affected", "version": "WCN6450"}, {"status": "affected", "version": "WCN6650"}, {"status": "affected", "version": "WCN6755"}, {"status": "affected", "version": "WCN7750"}, {"status": "affected", "version": "WCN7860"}, {"status": "affected", "version": "WCN7861"}, {"status": "affected", "version": "WCN7880"}, {"status": "affected", "version": "WCN7881"}, {"status": "affected", "version": "WSA8830"}, {"status": "affected", "version": "WSA8832"}, {"status": "affected", "version": "WSA8835"}, {"status": "affected", "version": "WSA8840"}, {"status": "affected", "version": "WSA8845"}, {"status": "affected", "version": "WSA8845H"}], "platforms": ["Snapdragon Auto", "Snapdragon Industrial IOT", "Snapdragon MC", "Snapdragon Mobile", "Snapdragon Wired Infrastructure and Networking"], "defaultStatus": "unaffected"}], "references": [{"url": "https://docs.qualcomm.com/product/publicresources/securitybulletin/june-2025-bulletin.html"}], "descriptions": [{"lang": "en", "value": "Transient DOS while processing the tone measurement response buffer when the response buffer is out of range."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-126", "description": "CWE-126 Buffer Over-read"}]}], "providerMetadata": {"orgId": "2cfc7d3e-20d3-47ac-8db7-1b7285aff15f", "shortName": "qualcomm", "dateUpdated": "2025-06-03T05:53:04.451Z"}}}, "cveMetadata": {"cveId": "CVE-2025-27029", "state": "PUBLISHED", "dateUpdated": "2025-06-03T14:49:01.250Z", "dateReserved": "2025-02-18T09:19:46.882Z", "assignerOrgId": "2cfc7d3e-20d3-47ac-8db7-1b7285aff15f", "datePublished": "2025-06-03T05:53:04.451Z", "assignerShortName": "qualcomm"}, "dataVersion": "5.1"}