CVE-2024-53027
Published: 03 March 2025
Summary
CVE-2024-53027 is a high-severity Classic Buffer Overflow (CWE-120) vulnerability in Qualcomm Qca9367 Firmware. Its CVSS base score is 7.5 (High).
Operationally, exploitation aligns with the MITRE ATT&CK technique Application or System Exploitation (T1499.004); ranked in the top 43.2% of CVEs by exploit likelihood; it is not currently listed in the CISA KEV catalog.
The strongest mitigations our analysis identified are NIST 800-53 SC-5 (Denial-of-service Protection) and SI-10 (Information Input Validation).
Threat & Defense at a Glance
Threat & Defense Details
Mitigating Controls (NIST 800-53 r5)AI
Information input validation directly prevents buffer overflows like CWE-120 by enforcing size checks on country IE inputs before processing.
Flaw remediation requires applying Qualcomm patches to fix the specific unchecked buffer copy vulnerability causing transient DoS.
Denial-of-service protection implements resource limits and filtering to block or mitigate remote unauthenticated DoS from malformed country IEs.
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
Buffer overflow in network packet processing (country IE) directly enables remote application/system crash for DoS via exploitation.
NVD Description
Transient DOS may occur while processing the country IE.
Deeper analysisAI
CVE-2024-53027 is a vulnerability that may cause a transient denial-of-service (DoS) condition while processing the country information element (IE). It is associated with CWE-120 (Buffer Copy without Checking Size of Input) and affects components in Qualcomm products.
The vulnerability has a CVSS v3.1 base score of 7.5 (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H), indicating it can be exploited remotely by an unauthenticated attacker with low attack complexity and no user interaction. Successful exploitation results in high-impact disruption to availability through a transient DoS, with no impact on confidentiality or integrity.
Qualcomm has published details and mitigation guidance in its March 2025 Security Bulletin, available at https://docs.qualcomm.com/product/publicresources/securitybulletin/march-2025-bulletin.html.
Details
- CWE(s)