Summary
Multiple vulnerabilities in a Qualcomm component have been reported in a closed-source report. This component is an integral part of the radio chip found in several Endress+Hauser products.
Details
Impact
Due to the closed-source nature of the report, the impact remains uncertain. In the worst-case scenario, this could lead to a loss of availability, integrity, and confidentiality.
In the case of the Liquiline Edge Module EMR, integrity and confidentiality are not affected due to the system architecture. The TLS connection to the Netilion cloud is fully managed by the integrated Linux system, which ensures end-to-end encryption. The Qualcomm radio chip is only used to transmit already encrypted data over the mobile network. Nevertheless, a complete loss of availability is still possible.
Mitigation
If a firmware update is no longer possible, it is recommended to replace the device.
Remediation
Endress+Hauser has released an updated firmware for the affected device that includes a security patch for the radio chip to address this vulnerability. Customers are encouraged to update their devices to the latest firmware version as soon as possible. For assistance, please contact your local Endress+Hauser service center.
Vulnerabilities 108
-
Critical 9.8
Buffer Copy Without Checking Size of Input in MODEM
Memory correction in modem due to buffer overwrite during coap connection
-
Critical 9.8
Improper Input Validation in MODEM
Memory corruption in modem due to improper length check while copying into memory
-
Critical 9.8
Buffer Copy Without Checking Size of Input in MODEM
Memory corruption in modem due to buffer overwrite while building an IPv6 multicast address based on the MAC address of the iface
-
Critical 9.8
Improper Input Validation in MODEM
memory corruption in modem due to improper check while calculating size of serialized CoAP message
-
Critical 9.8
Buffer copy without checking the size of input in Modem
Memory corruption due to buffer copy without checking the size of input in modem while decoding raw SMS received.
-
High 8.4
Memory corruption in MODEM due to Improper Validation of Array Index while processing GSTK Proactive commands in Snapdr…
-
High 8.4
Memory corruption in i2c buses due to improper input validation while reading address configuration from i2c driver in …
-
High 8.4
Memory corruption in SPI buses due to improper input validation while reading address configuration from spi buses in S…
-
High 8.2
Out of bound read occurs while processing crafted SDP due to lack of check of null string in Snapdragon Auto, Snapdrago…
-
High 8.2
Out-of-bounds read vulnerability while accessing DTMF payload due to lack of check of buffer length before copying in S…
-
High 8.2
Buffer Over-read in MODEM
Information disclosure in modem data due to array out of bound access while handling the incoming DNS response packet
-
High 8.2
Buffer Over-read in MODEM
Information disclosure in modem due to buffer over-read while processing response from DNS server
-
High 8.2
Buffer Over-read in MODEM
Information disclosure in modem due to improper check of IP type while processing DNS server query
-
High 8.2
Buffer Over-read in MODEM
Information disclosure in modem due to buffer over read in dns client due to missing length check
-
High 8.2
Buffer Over-read in MODEM
Information disclosure in modem due to buffer over-red while performing checksum of packet received
-
High 8.2
Buffer Over-read in MODEM
Information disclosure in modem due to improper input validation during parsing of upcoming CoAP message
-
High 8.2
Buffer over-read in Modem
Information disclosure due to buffer over-read while parsing DNS response packets in Modem.
-
High 8.2
Buffer over-read in Modem
Information disclosure sue to buffer over-read in modem while processing ipv6 packet with hop-by-hop or destination option in header.
-
High 8.2
Buffer over-read in Modem
Information disclosure due to buffer over-read in Modem while using static array to process IPv4 packets.
-
High 8.2
Information disclosure due to buffer over-read in WLAN firmware while parsing security context info attributes. in Snap…
-
High 8.2
Buffer Over-read in Network Services
Information disclosure in Network Services due to buffer over-read while the device receives DNS response.
-
High 7.5
Possible assertion due to improper handling of IPV6 packet with invalid length in destination options header in Snapdra…
-
High 7.5
Denial of service in modem due to reachable assertion while processing reconfiguration message in Snapdragon Auto, Snap…
-
High 7.5
Incorrect Calculation of Buffer Size in MODEM
Information disclosure in modem due to buffer over-read while processing packets from DNS server
-
High 7.5
Null Pointer Dereference in MODEM
Denial of service in modem due to null pointer dereference while processing DNS packets
-
High 7.5
Loop with Unreachable Exit Condition in MODEM
Denial of service in modem due to missing null check while processing IP packets with padding
-
High 7.5
Null Pointer Dereference in MODEM
Denial of service in modem due to missing null check while processing TCP or UDP packets from server
-
High 7.5
Use of Uninitialized Variable in MODEM
Information disclosure in modem due to missing NULL check while reading packets received from local network
-
High 7.5
Null Point Dereference in MODEM
Denial of service in modem due to missing null check while processing the ipv6 packet received during ECM call
-
High 7.5
Memory Corruption in MODEM
Memory corruption in modem due to buffer overflow while processing a PPP packet
-
High 7.5
Null pointer dereference in Modem
Transient DOS in Modem due to null pointer dereference while processing the incoming packet with http chunked encoding.
-
High 7.5
Transient DOS due to loop with unreachable exit condition in WLAN while processing an incoming FTM frames. in Snapdrago…
-
High 7.5
NULL pointers dereference in Modem
Transient DOS due to NULL pointer dereference in Modem while performing pullup for received TCP/UDP packet.
-
Medium 5.1
Out of bound read can happen in Widevine TA while copying data to buffer from user data due to lack of check of buffer …
-
Unscored —
Due to the use of non-time-constant comparison functions there is issue in timing side channels which can be used as a …
-
Unscored —
Infinite loop while decoding compressed data can lead to overrun condition in Snapdragon Auto, Snapdragon Compute, Snap…
-
Unscored —
Buffer over read can happen while parsing SMS OTA messages at transport layer if network sends un-intended values in Sn…
-
Unscored —
While processing MT Secondary PDP request, Buffer overflow will happen due to incorrect calculation of buffer size in S…
-
Unscored —
Possibility of memory overflow while decoding GSNDCP compressed mode PDU in Snapdragon Auto, Snapdragon Compute, Snapdr…
-
Unscored —
Possibility of Null pointer access if the SPDM commands are executed in the non-standard way in Trustzone in Snapdragon…
-
Unscored —
Multiple read overflows in MM while decoding service accept,service reject,attach reject and MT detach in Snapdragon Au…
-
Unscored —
u'SMEM partition can be manipulated in case of any compromise on HLOS, thus resulting in access to memory outside of SM…
-
Unscored —
Multiple Buffer Over-read issue can happen due to improper length checks while decoding Service Reject/RAU Reject/PTMSI…
-
Unscored —
Multiple Read overflows due to improper length checks while decoding authentication in Cs domain/RAU Reject and TC cmd …
-
Unscored —
Multiple Read overflows issue due to improper length check while decoding Identity Request in CSdomain/Authentication R…
-
Unscored —
Lack of boundary checks for data offsets received from HLOS can lead to out-of-bound read in Snapdragon Auto, Snapdrago…
-
Unscored —
Improper input validation while processing SIP URI received from the network will lead to buffer over-read and then to …
-
Unscored —
Filling media attribute tag names without validating the destination buffer size which can result in the buffer overflo…
-
Unscored —
Out of bound write can happen due to lack of check of array index value while calculating it. in Snapdragon Auto, Snapd…
-
Unscored —
UTCB object has a function pointer called by the reaper to deallocate its memory resources and this address can potenti…
-
Unscored —
u'Possibility of integer overflow in keymaster 4 while allocating memory due to multiplication of large numcerts value …
-
Unscored —
u'Memory can be potentially corrupted if random index is allowed to manipulate TLB entries in Kernel from user library'…
-
Unscored —
u'Lack of check that the current received data fragment size of a particular packet that are read from shared memory ar…
-
Unscored —
u'Lack of integer overflow check for addition of fragment size and remaining size that are read from shared memory can …
-
Unscored —
u'Lack of check that the TX FIFO write and read indices that are read from shared RAM are less than the FIFO size resul…
-
Unscored —
u'Lack of check for integer overflow for round up and addition operations result into memory corruption and potential i…
-
Unscored —
Lack of check that the RX FIFO write index that is read from shared RAM is less than the FIFO size results into memory …
-
Unscored —
Due to the use of non-time-constant comparison functions there is issue in timing side channels which can be used as a …
-
Unscored —
Multiple Read overflows issue due to improper length check while decoding 3G attach accept/ SMS/ pdn connection reject/…
-
Unscored —
A stack-based buffer overflow exists in the initialization of the identification stage due to lack of check on the numb…
-
Unscored —
Multiple Read overflows issue due to improper length check while decoding RAU accept/PDN disconnect Rej/Modify EPS ctxt…
-
Unscored —
Multiple Read overflows issue due to improper length check while decoding dedicated_eps_bearer_req/ act_def_context_req…
-
Unscored —
Error occurs While extracting the ipv6_header having an invalid length due to lack of length check in Snapdragon Auto, …
-
Unscored —
The size of a buffer is determined by addition and multiplications operations that have the potential to overflow due t…
-
Unscored —
Multiple Read overflows issue due to improper length check while decoding tau reject/tau accept/detach request/attach r…
-
Unscored —
Out of bound read in in fingerprint application due to requested data assigned to a local buffer without length check i…
-
Unscored —
Out of bound read in Fingerprint application due to requested data is being used without length check in Snapdragon Aut…
-
Unscored —
Out-of-bound writes occurs due to lack of check of buffer size will cause buffer overflow only in 32bit architecture. i…
-
Unscored —
u'Possible integer overflow in API due to lack of check on large oid range count in cert extension field' in Snapdragon…
-
Unscored —
Buffer overflows while decoding setup message from Network due to lack of check of IE message length received from netw…
-
Unscored —
u'Pointer double free in HavenSvc due to not setting the pointer to NULL after freeing it' in Snapdragon Auto, Snapdrag…
-
Unscored —
Integer overflow in calculating estimated output buffer size when getting a list of installed Feature IDs, Serial Numbe…
-
Unscored —
Using non-time-constant functions like memcmp to compare sensitive data can lead to information leakage through timing …
-
Unscored —
Compromised reset handler may bypass access control due to AC config is being reset if debug path is enabled to collect…
-
Unscored —
u'Heap overflow in diag command handler due to lack of check of packet length received from user' in Snapdragon Auto, S…
-
Unscored —
Buffer overflow occurs while processing an subsample data length out of range due to lack of user input validation in S…
-
Unscored —
Out of bound memory access while processing ese transmit command due to passing Response buffer received from user in S…
-
Unscored —
Integer overflow in diag command handler when user inputs a large value for number of tasks field in the request packet…
-
Unscored —
Out of bounds read can happen in diag event set mask command handler when user provided length in the command request i…
-
Unscored —
u'Information disclosure issue occurs as in current logic as secure touch is released without clearing the display sess…
-
Unscored —
u'While processing SMCInvoke asynchronous message header, message count is modified leading to a TOCTOU race condition …
-
Unscored —
Information disclosure due to lack of address range check done on the SysDBG buffers in SDI code. in Snapdragon Auto, S…
-
Unscored —
SNDCP module may access array out side its boundary when it receives malformed XID message. in Snapdragon Auto, Snapdra…
-
Unscored —
Possible out of bounds write in a MT SMS/SS scenario due to improper validation of array index in Snapdragon Auto, Snap…
-
Unscored —
While processing Attach Reject message, Valid exit condition is not met resulting into an infinite loop in Snapdragon A…
-
Unscored —
While Skipping unknown IES, EMM is reading the buffer even if the no of bytes to read are more than message length whic…
-
Unscored —
Buffer over-read while UE process invalid DL ROHC packet for decompression due to lack of check of size of compresses p…
-
Unscored —
Divide by zero issue can happen while updating delta extension header due to improper validation of master SN and exten…
-
Unscored —
Potential out of bound read exception when UE receives unusually large number of padding octets in the beginning of ROH…
-
Unscored —
Out of bound memory access while playing music playbacks with crafted vorbis content due to improper checks in header e…
-
Unscored —
Buffer over-read can happen while parsing received SDP values due to lack of NULL termination check on SDP in Snapdrago…
-
Unscored —
User can overwrite Security Code NV item without knowing current SPC due to improper validation of SPC code setting and…
-
Unscored —
Trusted APPS to overwrite the CPZ memory of another use-case as TZ only checks the physical address not overlapping wit…
-
Unscored —
Buffer over-read can happen while parsing received SDP values due to lack of NULL termination check on SDP in Snapdrago…
-
Unscored —
Buffer over-read can happen while parsing received SDP values due to lack of NULL termination check on SDP in Snapdrago…
-
Unscored —
Buffer over-read can happen while parsing received SDP values due to lack of NULL termination check on SDP in Snapdrago…
-
Unscored —
Possible memory corruption and information leakage in sub-system due to lack of check for validity and boundary complia…
-
Unscored —
Out of bound memory read in Data modem while unpacking data due to lack of offset length check in Snapdragon Auto, Snap…
-
Unscored —
Possible memory corruption while processing EAPOL frames due to lack of validation of key length before using it in Sna…
-
Unscored —
u'Lack of check of integer overflow while doing a round up operation for data read from shared memory for G-link SMEM t…
-
Unscored —
u'Lack of check to ensure that the TX read index & RX write index that are read from shared memory are less than the FI…
-
Unscored —
u'Channel name string which has been read from shared memory is potentially subjected to string manipulations but not v…
-
Unscored —
u'A potential buffer overflow exists due to integer overflow when parsing handler options due to wrong data type usage …
-
Unscored —
u'Multiple Read overflows issue due to improper length check while decoding Generic NAS transport/EMM info' in Snapdrag…
-
Unscored —
u'Information disclosure issue can occur due to partial secure display-touch session tear-down' in Snapdragon Auto, Sna…
-
Unscored —
u'Information disclosure issue occurs as in current logic Secure Touch session is released without terminating display …
-
Unscored —
u'Potential out of bounds read while processing downlink NAS transport message due to improper length check of Informat…
-
Unscored —
Possible memory out of bound issue during music playback when an incorrect bit stream content is copied into array with…
Revision history
-
#1.1.0
Updated CPEs
-
#1.0.0
Initial version
References
-
Endress+Hauser
https://www.endress.com
-
CERT@VDE Security Advisories for Endress+Hauser
https://certvde.com/en/advisories/vendor/endress+hauser
-
VDE-2025-107: Endress+Hauser: Multiple products affected by Qualcomm vulnerabilities - HTML
https://certvde.com/en/advisories/VDE-2025-107