CVE-2017-18280

Severity: high (CVSS 7.8 v3.0)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.2% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2018-09-20 · updated 2026-06-17

Description

In Snapdragon (Automobile, Mobile, Wear) in version MDM9607, MSM8909W, MSM8996AU, SD 210/SD 212/SD 205, SD 425, SD 427, SD 430, SD 435, SD 450, SD 617, SD 625, SD 650/52, SD 820, SD 820A, SD 835, SDM429, SDM439, SDM632, Snapdragon_High_Med_2016, when a Trusted Application has opened the SPI/I2C interface to a particular device, it is possible for another Trusted Application to read the data on this open interface by calling the SPI/I2C read function.

Affected products

Qualcomm Mdm9607 Firmware: all versions
Qualcomm Msm8909W Firmware: all versions
Qualcomm Msm8996Au Firmware: all versions
Qualcomm Sd205 Firmware: all versions
Qualcomm Sd210 Firmware: all versions
Qualcomm Sd212 Firmware: all versions
Qualcomm Sd425 Firmware: all versions
Qualcomm Sd427 Firmware: all versions
Qualcomm Sd430 Firmware: all versions
Qualcomm Sd435 Firmware: all versions
Qualcomm Sd450 Firmware: all versions
Qualcomm Sd617 Firmware: all versions
Qualcomm Sd625 Firmware: all versions
Qualcomm Sd650 Firmware: all versions
Qualcomm Sd652 Firmware: all versions
Qualcomm Sd820 Firmware: all versions
Qualcomm Sd820A Firmware: all versions
Qualcomm Sd835 Firmware: all versions
Qualcomm Sdm429 Firmware: all versions
Qualcomm Sdm439 Firmware: all versions
Qualcomm Sdm632 Firmware: all versions

References

Get alerted when CVE-2017-18280 or the next vulnerability affects your stack