CVE-2020-11117

Severity: critical (CVSS 9.8 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 19.7% probability of exploitation in the next 30 days
Public exploit or detection template: yes
Published: 2020-09-08 · updated 2026-06-17
Weakness: CWE-77

Description

u'In the lbd service, an external user can issue a specially crafted debug command to overwrite arbitrary files with arbitrary content resulting in remote code execution.' in Snapdragon Connectivity, Snapdragon Consumer IOT, Snapdragon Wired Infrastructure and Networking in IPQ4019, IPQ6018, IPQ8064, IPQ8074, QCA4531, QCA9531, QCA9980

Affected products

Qualcomm Ipq4019 Firmware: all versions
Qualcomm Ipq6018 Firmware: all versions
Qualcomm Ipq8064 Firmware: all versions
Qualcomm Ipq8074 Firmware: all versions
Qualcomm Qca4531 Firmware: all versions
Qualcomm Qca9531 Firmware: all versions
Qualcomm Qca9980 Firmware: all versions

References

https://www.qualcomm.com/company/product-security/bulletins/august-2020-bulletin
https://www.talosintelligence.com/vulnerability_reports/TALOS-2020-1065
https://www.qualcomm.com/company/product-security/bulletins/august-2020-bulletin
https://www.talosintelligence.com/vulnerability_reports/TALOS-2020-1065

Get alerted when CVE-2020-11117 or the next vulnerability affects your stack