CVE-2023-28556

Q: What is the severity of CVE-2023-28556?

CVE-2023-28556 has a CVSS score of 7.1 (HIGH). A cryptographic vulnerability in Qualcomm's HLOS (High-Level Operating System) during key management allows potential unauthorized access to sensitive cryptographic material. This affects devices using Qualcomm chipsets with vulnerable firmware. Attackers could potentially extract or manipulate cryptographic keys used for device security.

7.1 HIGH

📋 TL;DR

A cryptographic vulnerability in Qualcomm's HLOS (High-Level Operating System) during key management allows potential unauthorized access to sensitive cryptographic material. This affects devices using Qualcomm chipsets with vulnerable firmware. Attackers could potentially extract or manipulate cryptographic keys used for device security.

💻 Affected Systems

Products:

Qualcomm chipsets with vulnerable HLOS firmware

Versions: Specific firmware versions as listed in Qualcomm advisories

Operating Systems: Android, Linux-based mobile operating systems

Default Config Vulnerable: ⚠️ Yes

Notes: Affects devices using Qualcomm Secure Execution Environment (QSEE) and related security frameworks

📦 What is this software?

⚠️ Risk & Real-World Impact

🔴

Worst Case

Complete compromise of device security, allowing extraction of encryption keys, authentication bypass, and potential data exfiltration.

🟠

Likely Case

Limited cryptographic material exposure that could facilitate further attacks on specific security functions.

🟢

If Mitigated

Minimal impact with proper key management controls and isolation mechanisms in place.

🌐 Internet-Facing: MEDIUM

🏢 Internal Only: HIGH

🎯 Exploit Status

Public PoC: ✅ No

Weaponized: UNKNOWN

Unauthenticated Exploit: ✅ No

Complexity: HIGH

Exploitation requires local access or privileged execution on the device

🛠️ Fix & Mitigation

✅ Official Fix

Patch Version: Refer to Qualcomm security bulletin for specific patched firmware versions

Vendor Advisory: https://www.qualcomm.com/company/product-security/bulletins/november-2023-bulletin

Restart Required: Yes

Instructions:

1. Check Qualcomm security bulletin for affected chipset models. 2. Contact device manufacturer for firmware updates. 3. Apply firmware update following manufacturer instructions. 4. Reboot device after update.

🔧 Temporary Workarounds

Restrict physical access

all

Limit physical access to vulnerable devices to reduce attack surface

Disable unnecessary services

linux

Disable unused cryptographic services and key management functions

🧯 If You Can't Patch

Isolate vulnerable devices on separate network segments
Implement strict access controls and monitoring for cryptographic operations

🔍 How to Verify

Check if Vulnerable:

Check device firmware version against Qualcomm security bulletin. Use 'getprop ro.build.fingerprint' on Android devices to identify build information.

Check Version:

On Android: 'getprop ro.build.version.security_patch' and 'getprop ro.bootloader'

Verify Fix Applied:

Verify firmware version has been updated to patched version listed in Qualcomm advisory.

📡 Detection & Monitoring

Log Indicators:

Unusual cryptographic service access
Key management operation failures
Secure execution environment errors

Network Indicators:

Unexpected cryptographic protocol traffic
Unusual key exchange patterns

SIEM Query:

source="device_logs" AND ("key_management" OR "crypto_failure" OR "QSEE")

📊 Metadata

CVE ID: CVE-2023-28556

CVSS v3 Score: 7.1 (HIGH)

CVSS Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N

CWE: CWE-285

Published: November 7, 2023

Last Updated: August 11, 2025

🔗 References

https://www.qualcomm.com/company/product-security/bulletins/november-2023-bulletin Vendor Advisory
https://www.qualcomm.com/company/product-security/bulletins/november-2023-bulletin Vendor Advisory

📋 TL;DR

💻 Affected Systems

📦 What is this software?

315 5g Iot Modem Firmware by Qualcomm

9205 Lte Modem Firmware by Qualcomm

Aqt1000 Firmware by Qualcomm

Ar8031 Firmware by Qualcomm

Ar8035 Firmware by Qualcomm

C V2x 9150 Firmware by Qualcomm

Csra6620 Firmware by Qualcomm

Csra6640 Firmware by Qualcomm

Csrb31024 Firmware by Qualcomm

Fastconnect 6200 Firmware by Qualcomm

Fastconnect 6700 Firmware by Qualcomm

Fastconnect 6800 Firmware by Qualcomm

Fastconnect 6900 Firmware by Qualcomm

Fastconnect 7800 Firmware by Qualcomm

Flight Rb5 5g Platform Firmware by Qualcomm

Fsm10056 Firmware by Qualcomm

Mdm9205s Firmware by Qualcomm

Qam8255p Firmware by Qualcomm

Qam8295p Firmware by Qualcomm

Qam8650p Firmware by Qualcomm

Qam8775p Firmware by Qualcomm

Qamsrv1h Firmware by Qualcomm

Qca4004 Firmware by Qualcomm

Qca6174a Firmware by Qualcomm

Qca6391 Firmware by Qualcomm

Qca6420 Firmware by Qualcomm

Qca6421 Firmware by Qualcomm

Qca6426 Firmware by Qualcomm

Qca6430 Firmware by Qualcomm

Qca6431 Firmware by Qualcomm

Qca6436 Firmware by Qualcomm

Qca6564 Firmware by Qualcomm

Qca6564a Firmware by Qualcomm

Qca6564au Firmware by Qualcomm

Qca6574 Firmware by Qualcomm

Qca6574a Firmware by Qualcomm

Qca6574au Firmware by Qualcomm

Qca6595 Firmware by Qualcomm

Qca6595au Firmware by Qualcomm

Qca6696 Firmware by Qualcomm

Qca6698aq Firmware by Qualcomm

Qca6797aq Firmware by Qualcomm

Qca8081 Firmware by Qualcomm

Qca8337 Firmware by Qualcomm

Qca9377 Firmware by Qualcomm

Qcc710 Firmware by Qualcomm

Qcm2290 Firmware by Qualcomm

Qcm4290 Firmware by Qualcomm

Qcm4325 Firmware by Qualcomm

Qcm4490 Firmware by Qualcomm

Qcm6125 Firmware by Qualcomm

Qcm6490 Firmware by Qualcomm

Qcm8550 Firmware by Qualcomm

Qcn6024 Firmware by Qualcomm

Qcn6224 Firmware by Qualcomm

Qcn6274 Firmware by Qualcomm

Qcn7606 Firmware by Qualcomm

Qcn9011 Firmware by Qualcomm

Qcn9012 Firmware by Qualcomm

Qcn9024 Firmware by Qualcomm

Qcn9074 Firmware by Qualcomm

Qcs2290 Firmware by Qualcomm

Qcs410 Firmware by Qualcomm

Qcs4290 Firmware by Qualcomm

Qcs4490 Firmware by Qualcomm

Qcs610 Firmware by Qualcomm

Qcs6125 Firmware by Qualcomm

Qcs6490 Firmware by Qualcomm

Qcs7230 Firmware by Qualcomm

Qcs8155 Firmware by Qualcomm

Qcs8250 Firmware by Qualcomm

Qcs8550 Firmware by Qualcomm

Qdu1000 Firmware by Qualcomm

Qdu1010 Firmware by Qualcomm

Qdu1110 Firmware by Qualcomm

Qdu1210 Firmware by Qualcomm

Qdx1010 Firmware by Qualcomm