Vulnerability Monitor

The vendors, products, and vulnerabilities you care about

CVE-2020-11209

Improper authorization in DSP process could allow unauthorized users to downgrade the library versions in SD820, SD821, SD820, QCS603, QCS605, SDA855, SA6155P, SA6145P, SA6155, SA6155P, SD855, SD 675, SD660, SD429, SD439

Security Impact Summary

This vulnerability carries a MEDIUM severity rating with a CVSS v3.1 score of 5.5, requiring local system access to exploit with relatively low complexity without requiring user interaction requiring only low-level privileges . The vulnerability impacts integrity (unauthorized modifications), for affected systems. Impacting 26 products from qualcomm, from qualcomm, from qualcomm and 23 others, organizations running these solutions should prioritize assessment and patching.

Historical Context

Reported in 2020, this vulnerability emerged during an era marked by increased sophistication in supply chain attacks, cloud infrastructure vulnerabilities, and software-as-a-service (SaaS) security challenges. Security practices during this period emphasized zero-trust architectures, container security, and API protection.

Published

2020-11-12T10:15:13.250

Last Modified

2024-11-21T04:57:16.010

Status

Modified

Source

[email protected]

Severity

CVSSv3.1: 5.5 (MEDIUM)

CVSSv2 Vector

AV:L/AC:L/Au:N/C:N/I:P/A:N

Access Vector: LOCAL
Access Complexity: LOW
Authentication: NONE
Confidentiality Impact: NONE
Integrity Impact: PARTIAL
Availability Impact: NONE

Exploitability Score

3.9

Impact Score

2.9

Weaknesses

Type: Primary
CWE-863

Affected Vendors & Products

Type	Vendor	Product	Version/Range	Vulnerable?
Operating System	qualcomm	sd820_firmware	-	Yes
Hardware	qualcomm	sd820	-	No
Operating System	qualcomm	sd821_firmware	-	Yes
Hardware	qualcomm	sd821	-	No
Operating System	qualcomm	qcs603_firmware	-	Yes
Hardware	qualcomm	qcs603	-	No
Operating System	qualcomm	qcs605_firmware	-	Yes
Hardware	qualcomm	qcs605	-	No
Operating System	qualcomm	sda855_firmware	-	Yes
Hardware	qualcomm	sda855	-	No
Operating System	qualcomm	sa6155p_firmware	-	Yes
Hardware	qualcomm	sa6155p	-	No
Operating System	qualcomm	sa6145p_firmware	-	Yes
Hardware	qualcomm	sa6145p	-	No
Operating System	qualcomm	sa6155_firmware	-	Yes
Hardware	qualcomm	sa6155	-	No
Operating System	qualcomm	sa6155p_firmware	-	Yes
Hardware	qualcomm	sa6155p	-	No
Operating System	qualcomm	sd855_firmware	-	Yes
Hardware	qualcomm	sd855	-	No
Operating System	qualcomm	sd_675_firmware	-	Yes
Hardware	qualcomm	sd_675	-	No
Operating System	qualcomm	sd660_firmware	-	Yes
Hardware	qualcomm	sd660	-	No
Operating System	qualcomm	sd429_firmware	-	Yes
Hardware	qualcomm	sd429	-	No
Operating System	qualcomm	sd439_firmware	-	Yes
Hardware	qualcomm	sd439	-	No

References

https://blog.checkpoint.com/2020/08/06/achilles-small-chip-big-peril/ Third Party Advisory ([email protected])
https://research.checkpoint.com/2021/pwn2own-qualcomm-dsp/ Exploit, Third Party Advisory ([email protected])
https://www.qualcomm.com/company/product-security/bulletins/november-2020-bulletin Broken Link, Vendor Advisory ([email protected])
https://blog.checkpoint.com/2020/08/06/achilles-small-chip-big-peril/ Third Party Advisory (af854a3a-2127-422b-91ae-364da2661108)
https://research.checkpoint.com/2021/pwn2own-qualcomm-dsp/ Exploit, Third Party Advisory (af854a3a-2127-422b-91ae-364da2661108)
https://www.qualcomm.com/company/product-security/bulletins/november-2020-bulletin Broken Link, Vendor Advisory (af854a3a-2127-422b-91ae-364da2661108)

How SecUtils Interprets This CVE

SecUtils normalizes and enriches National Vulnerability Database (NVD) records by standardizing vendor and product identifiers, aggregating vulnerability metadata from both NVD and MITRE sources, and providing structured context for security teams. For qualcomm's affected products, we extract Common Platform Enumeration (CPE) data, Common Weakness Enumeration (CWE) classifications, CVSS severity metrics, and reference data to enable rapid vulnerability prioritization and asset correlation. This record contains no exploit code, proof-of-concept instructions, or attack methodologies—only defensive intelligence necessary for patch management, risk assessment, and security operations.