CVE-2021-1906

Qualcomm Multiple Chipsets Detection of Error Condition Without Action

6.2 MEDIUMActively exploited (CISA KEV)EPSS 0.52%

Published7 May 2021
Added to CISA KEV3 Nov 2021
Remediation due17 Nov 2021

Description

Improper handling of address deregistration on failure can lead to new GPU address allocation failure. in Snapdragon Auto, Snapdragon Compute, Snapdragon Connectivity, Snapdragon Consumer IOT, Snapdragon Industrial IOT, Snapdragon Mobile, Snapdragon Voice & Music, Snapdragon Wearables

CVSS 3.1 breakdown

Attack vectorLocal

Attack complexityLow

Privileges requiredNone

User interactionNone

ScopeUnchanged

ConfidentialityNone

IntegrityNone

AvailabilityHigh

CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Affected products

Qualcomm Apq8009 Firmwareall versions

Qualcomm Apq8009w Firmwareall versions

Qualcomm Apq8017 Firmwareall versions

Qualcomm Apq8053 Firmwareall versions

Qualcomm Apq8064au Firmwareall versions

Qualcomm Apq8096au Firmwareall versions

Qualcomm Aqt1000 Firmwareall versions

Qualcomm Ar8031 Firmwareall versions

Qualcomm Ar8035 Firmwareall versions

Qualcomm Ar8151 Firmwareall versions

Qualcomm Csra6620 Firmwareall versions

Qualcomm Csra6640 Firmwareall versions

Qualcomm Csrb31024 Firmwareall versions

Qualcomm Fsm10055 Firmwareall versions

Qualcomm Fsm10056 Firmwareall versions

Qualcomm Mdm9150 Firmwareall versions

Qualcomm Mdm9206 Firmwareall versions

Qualcomm Mdm9250 Firmwareall versions

Qualcomm Mdm9607 Firmwareall versions

Qualcomm Mdm9626 Firmwareall versions

Qualcomm Mdm9628 Firmwareall versions

Qualcomm Mdm9650 Firmwareall versions

Qualcomm Msm8909w Firmwareall versions

Qualcomm Msm8917 Firmwareall versions

Remediation

No fixed version is recorded in the NVD data. Check the vendor advisory for the latest guidance.

Patch & vendor advisories

https://www.qualcomm.com/company/product-security/bulletins/may-2021-bulletin

References

https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2021-1906US Government Resource
https://www.qualcomm.com/company/product-security/bulletins/may-2021-bulletinPatchVendor Advisory

Frequently asked

Is CVE-2021-1906 being actively exploited?

Yes. CVE-2021-1906 is listed in the CISA Known Exploited Vulnerabilities (KEV) catalog, added 3 Nov 2021.

How severe is CVE-2021-1906?

CVE-2021-1906 has a CVSS 3.1 base score of 6.2, rated medium. EPSS estimates a 0.52% probability of exploitation.

Which products are affected by CVE-2021-1906?

Affected products include Qualcomm Apq8009 Firmware, Qualcomm Apq8009w Firmware, Qualcomm Apq8017 Firmware, Qualcomm Apq8053 Firmware, Qualcomm Apq8064au Firmware, and 19 more.

How do I fix CVE-2021-1906?

Apply the vendor's patch or advisory guidance, then verify no affected versions remain across your devices.

How Secuno handles this

Secuno correlates vulnerabilities like CVE-2021-1906 against the real software inventory on every managed device, as each hourly inventory arrives. Rather than a static severity, each match is scored in context: exploit availability, EPSS, the asset's exposure, and business criticality decide where it lands in the queue. Because it is on the CISA KEV list, a risk for it never ranks below high, and the update that fixes it moves to the Emergency patch lane. If an affected version is present anywhere across your portfolio, it surfaces automatically with a prioritised remediation path.

See how prioritisation works Book a demo

Data from the NVD, CISA KEV catalog and FIRST EPSS. CVSS 3.1 base score shown where available.