Cyber Posture

CVE-2024-53022

High

Published: 03 March 2025

Published
03 March 2025
Modified
06 March 2025
KEV Added
Patch
CVSS Score 7.8 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
EPSS Score 0.0015 35.2th percentile
Risk Priority 16 60% EPSS · 20% KEV · 20% CVSS

Summary

CVE-2024-53022 is a high-severity Improper Input Validation (CWE-20) vulnerability in Qualcomm Qam8255P Firmware. Its CVSS base score is 7.8 (High).

Operationally, exploitation aligns with the MITRE ATT&CK technique Exploitation for Privilege Escalation (T1068); ranked at the 35.2th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.

The strongest mitigations our analysis identified are NIST 800-53 SI-10 (Information Input Validation) and SI-16 (Memory Protection).

Threat & Defense at a Glance

What attackers do: exploitation maps to Exploitation for Privilege Escalation (T1068). What defenders deploy: see the NIST 800-53 controls recommended below.
Threat & Defense Details

Mitigating Controls (NIST 800-53 r5)AI

prevent

Directly addresses CWE-20 improper input validation in primary-guest VM communication channels that triggers memory corruption.

prevent

Implements memory protections such as ASLR and DEP to block exploitation of CWE-787 out-of-bounds writes during VM interactions.

prevent

Isolates host and guest VM processes to contain the impact of memory corruption originating in inter-VM communication handlers.

MITRE ATT&CK Enterprise TechniquesAI

T1068 Exploitation for Privilege Escalation Privilege Escalation
Adversaries may exploit software vulnerabilities in an attempt to elevate privileges.
Why these techniques?

Local memory corruption via improper input validation enables privilege escalation from low-priv guest/primary VM context.

Confidence: MEDIUM · MITRE ATT&CK Enterprise v18.1

NVD Description

Memory corruption may occur during communication between primary and guest VM.

Deeper analysisAI

CVE-2024-53022 is a memory corruption vulnerability that may occur during communication between the primary and guest virtual machines. It is associated with CWE-20 (Improper Input Validation) and CWE-787 (Out-of-bounds Write), carrying a CVSS v3.1 base score of 7.8 (AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H). The vulnerability affects components detailed in Qualcomm's security documentation.

A local attacker with low privileges can exploit this vulnerability with low complexity and no user interaction required. Successful exploitation enables high-impact consequences, including unauthorized access to confidential data, modification of system integrity, and disruption of availability through memory corruption.

Qualcomm's March 2025 Security Bulletin provides details on affected products, patches, and mitigation guidance, available at https://docs.qualcomm.com/product/publicresources/securitybulletin/march-2025-bulletin.html.

Details

CWE(s)

Affected Products

qualcomm
qam8255p firmware
all versions
qualcomm
qam8295p firmware
all versions
qualcomm
qam8620p firmware
all versions
qualcomm
qam8650p firmware
all versions
qualcomm
qam8775p firmware
all versions
qualcomm
qamsrv1h firmware
all versions
qualcomm
qamsrv1m firmware
all versions
qualcomm
qca6595 firmware
all versions
qualcomm
qca6595au firmware
all versions
qualcomm
qca6696 firmware
all versions
+13 more product configuration(s) — see NVD for full list

CVEs Like This One

CVE-2024-53012Same product: Qualcomm Qam8255P
CVE-2024-53031Same product: Qualcomm Qam8255P
CVE-2024-53029Same product: Qualcomm Qam8255P
CVE-2024-53030Same product: Qualcomm Qam8255P
CVE-2024-49837Same product: Qualcomm Qam8255P
CVE-2024-53032Same product: Qualcomm Qam8255P
CVE-2025-47363Same product: Qualcomm Qam8255P
CVE-2025-47393Same product: Qualcomm Qam8255P
CVE-2024-53028Same product: Qualcomm Qam8255P
CVE-2025-47346Same product: Qualcomm Qam8255P

References