Details of VAR-202503-0307

ID

VAR-202503-0307

CVE

CVE-2024-38426

TITLE

Authentication vulnerabilities in multiple Qualcomm products

Trust: 0.8

sources: JVNDB: JVNDB-2024-020278

DESCRIPTION

While processing the authentication message in UE, improper authentication may lead to information disclosure. 315 5g iot firmware, 9205 lte firmware, AR8035 Multiple Qualcomm products, such as firmware, contain vulnerabilities related to authentication.Information may be obtained

Trust: 1.62

sources: NVD: CVE-2024-38426 // JVNDB: JVNDB-2024-020278

AFFECTED PRODUCTS

vendor:	クアルコム	model:	315 5g iot	scope:	-	version:	-	Trust: 0.8
vendor:	クアルコム	model:	fastconnect 6900	scope:	-	version:	-	Trust: 0.8
vendor:	クアルコム	model:	qca6320	scope:	-	version:	-	Trust: 0.8
vendor:	クアルコム	model:	csra6620	scope:	-	version:	-	Trust: 0.8
vendor:	クアルコム	model:	qca6310	scope:	-	version:	-	Trust: 0.8
vendor:	クアルコム	model:	mdm9640	scope:	-	version:	-	Trust: 0.8
vendor:	クアルコム	model:	qca6391	scope:	-	version:	-	Trust: 0.8
vendor:	クアルコム	model:	fastconnect 6200	scope:	-	version:	-	Trust: 0.8
vendor:	クアルコム	model:	csrb31024	scope:	-	version:	-	Trust: 0.8
vendor:	クアルコム	model:	qca4004	scope:	-	version:	-	Trust: 0.8
vendor:	クアルコム	model:	fastconnect 7800	scope:	-	version:	-	Trust: 0.8
vendor:	クアルコム	model:	msm8996au	scope:	-	version:	-	Trust: 0.8
vendor:	クアルコム	model:	qca6174a	scope:	-	version:	-	Trust: 0.8
vendor:	クアルコム	model:	mdm9205s	scope:	-	version:	-	Trust: 0.8
vendor:	クアルコム	model:	csra6640	scope:	-	version:	-	Trust: 0.8
vendor:	クアルコム	model:	fastconnect 6800	scope:	-	version:	-	Trust: 0.8
vendor:	クアルコム	model:	mdm9628	scope:	-	version:	-	Trust: 0.8
vendor:	クアルコム	model:	fastconnect 6700	scope:	-	version:	-	Trust: 0.8
vendor:	クアルコム	model:	ar8035	scope:	-	version:	-	Trust: 0.8
vendor:	クアルコム	model:	9205 lte	scope:	-	version:	-	Trust: 0.8

sources: JVNDB: JVNDB-2024-020278

CVSS

SEVERITY

CVSSV2

CVSSV3

product-security@qualcomm.com:	CVE-2024-38426
value:	MEDIUM
Trust: 1.0
nvd@nist.gov:	CVE-2024-38426
value:	MEDIUM
Trust: 1.0
NVD:	CVE-2024-38426
value:	MEDIUM
Trust: 0.8

product-security@qualcomm.com:	CVE-2024-38426
baseSeverity:	MEDIUM
baseScore:	5.4
vectorString:	CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:L
attackVector:	ADJACENT
attackComplexity:	LOW
privilegesRequired:	NONE
userInteraction:	NONE
scope:	UNCHANGED
confidentialityImpact:	LOW
integrityImpact:	NONE
availabilityImpact:	LOW
exploitabilityScore:	2.8
impactScore:	2.5
version:	3.1
Trust: 1.0
nvd@nist.gov:	CVE-2024-38426
baseSeverity:	MEDIUM
baseScore:	5.3
vectorString:	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
attackVector:	NETWORK
attackComplexity:	LOW
privilegesRequired:	NONE
userInteraction:	NONE
scope:	UNCHANGED
confidentialityImpact:	LOW
integrityImpact:	NONE
availabilityImpact:	NONE
exploitabilityScore:	3.9
impactScore:	1.4
version:	3.1
Trust: 1.0
NVD:	CVE-2024-38426
baseSeverity:	MEDIUM
baseScore:	5.3
vectorString:	CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
attackVector:	NETWORK
attackComplexity:	LOW
privilegesRequired:	NONE
userInteraction:	NONE
scope:	UNCHANGED
confidentialityImpact:	LOW
integrityImpact:	NONE
availabilityImpact:	NONE
exploitabilityScore:	NONE
impactScore:	NONE
version:	3.0
Trust: 0.8

sources: JVNDB: JVNDB-2024-020278 // NVD: CVE-2024-38426 // NVD: CVE-2024-38426

PROBLEMTYPE DATA

problemtype:	CWE-287	Trust: 1.0
problemtype:	Inappropriate authentication (CWE-287) [ others ]	Trust: 0.8

sources: JVNDB: JVNDB-2024-020278 // NVD: CVE-2024-38426

EXTERNAL IDS

db:	NVD	id:	CVE-2024-38426	Trust: 2.6
db:	JVNDB	id:	JVNDB-2024-020278	Trust: 0.8

sources: JVNDB: JVNDB-2024-020278 // NVD: CVE-2024-38426

REFERENCES

url:	https://docs.qualcomm.com/product/publicresources/securitybulletin/march-2025-bulletin.html	Trust: 1.8
url:	https://nvd.nist.gov/vuln/detail/cve-2024-38426	Trust: 0.8

sources: JVNDB: JVNDB-2024-020278 // NVD: CVE-2024-38426

SOURCES

db:	JVNDB	id:	JVNDB-2024-020278
db:	NVD	id:	CVE-2024-38426

LAST UPDATE DATE

2025-03-13T22:56:14.665000+00:00

SOURCES UPDATE DATE

db:	JVNDB	id:	JVNDB-2024-020278	date:	2025-03-12T06:33:00
db:	NVD	id:	CVE-2024-38426	date:	2025-03-06T15:21:24.387

SOURCES RELEASE DATE

db:	JVNDB	id:	JVNDB-2024-020278	date:	2025-03-12T00:00:00
db:	NVD	id:	CVE-2024-38426	date:	2025-03-03T11:15:11.260