Snapdragon Auto, Snapdragon Connectivity…: Unchecked Return Value

What to do

1. Check which version of Snapdragon Auto, Snapdragon Connectivity, Snapdragon Consumer Electronics Connectivity, Snapdragon Consumer IOT, Snapdragon Industrial IOT, Snapdragon IoT, Snapdragon Mobile, Snapdragon Voice & Music, Snapdragon Wearables, Snapdragon Wired Infrastructure and Networking you run against the affected versions below, and install the vendor's latest release.
2. Read the advisory on qualcomm.com for workarounds and exact fixed builds.
3. Until you can update, restrict network access to the affected service so it is not reachable from untrusted networks.

Affected products and versions

Version data comes from the organisation that assigned the CVE; 35 further products are omitted here. Confirm against the vendor advisory before deciding you are unaffected.

How the severity score breaks down

Attack vector

NetworkCan be exploited remotely over a network, including the internet.

Attack complexity

LowNo special conditions are needed; the attack works reliably.

Privileges required

NoneNo account or login is needed.

User interaction

NoneNo action by a victim is required.

Scope

UnchangedImpact stays within the vulnerable component.

Confidentiality

HighAll data handled by the component can be read.

Integrity

HighData or code can be modified at will.

Availability

HighThe component can be taken down completely.

Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H. Scored by NVD.

Official description

Cryptographic issue in WLAN due to improper check on return value while authentication handshake in Snapdragon Auto, Snapdragon Connectivity, Snapdragon Consumer Electronics Connectivity, Snapdragon Consumer IOT, Snapdragon Industrial IOT, Snapdragon IoT, Snapdragon Mobile, Snapdragon Voice & Music, Snapdragon Wearables, Snapdragon Wired Infrastructure and Networking

Source: the CVE record as published by its numbering authority, via NVD and CVE.org.

The underlying weakness: Unchecked Return Value

Timeline

1. October 19, 2022CVE record published.
2. May 9, 2025CISA published its SSVC assessment (exploitation: none, automatable: yes, technical impact: total).
3. June 17, 2026Record last changed materially (score, affected products, status or references).

References

Other vulnerabilities in Snapdragon Auto, Snapdragon Connectivity, Snapdragon Consumer Electronics Connectivity, Snapdragon Consumer IOT, Snapdragon Industrial IOT, Snapdragon IoT, Snapdragon Mobile, Snapdragon Voice & Music, Snapdragon Wearables, Snapdragon Wired Infrastructure and Networking

• 9.1 Critical severity

  Snapdragon Auto, Snapdragon Connectivity…: Out-of-bounds Read

  CVE-2022-25719Oct 19, 2022Qualcomm

Recent Unchecked Return Value vulnerabilities

• 7.5 High severity

  Junos OS: Unchecked Return Value

  CVE-2022-22231Oct 18, 2022Juniper Networks
• 7.5 High severity

  Tizenrt: Unchecked Return Value

  CVE-2022-40279Sep 29, 2022SamsungEPSS 1.5%
• 7.5 High severity

  undertow: Unchecked Return Value

  CVE-2022-1319Aug 31, 2022UndertowEPSS 1.7%
• 7.5 High severity

  openzeppelin-contracts: Unchecked Return Value

  CVE-2022-31170Jul 22, 2022OpenZeppelin
• 7.5 High severity

  parse-server: Unchecked Return Value

  CVE-2022-31089Jun 27, 2022Parse-communityEPSS 1.16%
• 7.5 High severity

  posix: Unchecked Return Value

  CVE-2022-21211Jun 10, 2022PosixEPSS 1.06%

Spotted an error? Tell us.