CVE-2023-28578

Q: What is the severity of CVE-2023-28578?

CVE-2023-28578 has a CVSS score of 9.3 (CRITICAL). CVE-2023-28578 is a memory corruption vulnerability in Qualcomm Core Services that occurs when removing a single event listener. This allows attackers to potentially execute arbitrary code or cause denial of service on affected devices. The vulnerability affects Qualcomm chipsets used in smartphones, IoT devices, and other embedded systems.

9.3 CRITICAL

Remote Code Execution Denial of Service

📋 TL;DR

CVE-2023-28578 is a memory corruption vulnerability in Qualcomm Core Services that occurs when removing a single event listener. This allows attackers to potentially execute arbitrary code or cause denial of service on affected devices. The vulnerability affects Qualcomm chipsets used in smartphones, IoT devices, and other embedded systems.

💻 Affected Systems

Products:

Qualcomm chipsets with Core Services component

Versions: Multiple Qualcomm chipset versions prior to March 2024 security updates

Operating Systems: Android, Embedded Linux systems using Qualcomm chipsets

Default Config Vulnerable: ⚠️ Yes

Notes: Affects devices using vulnerable Qualcomm chipsets regardless of OEM implementation.

📦 What is this software?

⚠️ Risk & Real-World Impact

🔴

Worst Case

Remote code execution leading to complete device compromise, data theft, or persistent backdoor installation.

🟠

Likely Case

Application crashes, denial of service, or limited privilege escalation within the affected service context.

🟢

If Mitigated

Contained service disruption without system-wide impact if proper sandboxing and privilege separation are implemented.

🌐 Internet-Facing: MEDIUM

🏢 Internal Only: HIGH

🎯 Exploit Status

Public PoC: ✅ No

Weaponized: UNKNOWN

Unauthenticated Exploit: ⚠️ Yes

Complexity: MEDIUM

Memory corruption vulnerabilities typically require specific conditions to trigger but can be exploited remotely if the affected service is exposed.

🛠️ Fix & Mitigation

✅ Official Fix

Patch Version: March 2024 Qualcomm security updates

Vendor Advisory: https://www.qualcomm.com/company/product-security/bulletins/march-2024-bulletin

Restart Required: Yes

Instructions:

1. Check with device manufacturer for available security updates. 2. Apply March 2024 or later Qualcomm security patches. 3. Reboot device after patch installation. 4. Verify patch installation through system settings.

🔧 Temporary Workarounds

Disable unnecessary services

all

Reduce attack surface by disabling non-essential Qualcomm services if possible

Network segmentation

all

Isolate affected devices from untrusted networks

🧯 If You Can't Patch

Implement strict network access controls to limit exposure
Monitor for abnormal process behavior or crashes in Core Services

🔍 How to Verify

Check if Vulnerable:

Check device security patch level - if before March 2024, likely vulnerable. Check Qualcomm chipset version against advisory.

Check Version:

On Android: Settings > About phone > Android version > Security patch level

Verify Fix Applied:

Verify security patch level includes March 2024 or later Qualcomm updates in device settings.

📡 Detection & Monitoring

Log Indicators:

Unexpected crashes in Qualcomm services
Memory access violations in system logs
Abnormal process termination

Network Indicators:

Unusual network traffic to/from Qualcomm services
Connection attempts to unexpected ports

SIEM Query:

process_name:"qualcomm" AND (event_type:crash OR memory_violation)

📊 Metadata

CVE ID: CVE-2023-28578

CVSS v3 Score: 9.3 (CRITICAL)

CVSS Vector: CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H

CWE: CWE-20

Published: March 4, 2024

Last Updated: August 11, 2025

🔗 References

https://www.qualcomm.com/company/product-security/bulletins/march-2024-bulletin Vendor Advisory
https://www.qualcomm.com/company/product-security/bulletins/march-2024-bulletin Vendor Advisory

📋 TL;DR

💻 Affected Systems

📦 What is this software?

315 5g Iot Modem Firmware by Qualcomm

Aqt1000 Firmware by Qualcomm

Ar8031 Firmware by Qualcomm

Ar8035 Firmware by Qualcomm

Ar9380 Firmware by Qualcomm

C V2x 9150 Firmware by Qualcomm

Csr8811 Firmware by Qualcomm

Csra6620 Firmware by Qualcomm

Csra6640 Firmware by Qualcomm

Csrb31024 Firmware by Qualcomm

Fastconnect 6200 Firmware by Qualcomm

Fastconnect 6700 Firmware by Qualcomm

Fastconnect 6800 Firmware by Qualcomm

Fastconnect 6900 Firmware by Qualcomm

Fastconnect 7800 Firmware by Qualcomm

Flight Rb5 5g Firmware by Qualcomm

Fsm10055 Firmware by Qualcomm

Fsm10056 Firmware by Qualcomm

Immersive Home 214 Firmware by Qualcomm

Immersive Home 216 Firmware by Qualcomm

Immersive Home 316 Firmware by Qualcomm

Immersive Home 318 Firmware by Qualcomm

Immersive Home 3210 Firmware by Qualcomm

Immersive Home 326 Firmware by Qualcomm

Ipq5010 Firmware by Qualcomm

Ipq5028 Firmware by Qualcomm

Ipq5302 Firmware by Qualcomm

Ipq5312 Firmware by Qualcomm

Ipq5332 Firmware by Qualcomm

Ipq6010 Firmware by Qualcomm

Ipq6018 Firmware by Qualcomm

Ipq6028 Firmware by Qualcomm

Ipq8064 Firmware by Qualcomm

Ipq8065 Firmware by Qualcomm

Ipq8068 Firmware by Qualcomm

Ipq8070 Firmware by Qualcomm

Ipq8070a Firmware by Qualcomm

Ipq8071a Firmware by Qualcomm

Ipq8072a Firmware by Qualcomm

Ipq8074a Firmware by Qualcomm

Ipq8076 Firmware by Qualcomm

Ipq8076a Firmware by Qualcomm

Ipq8078 Firmware by Qualcomm

Ipq8078a Firmware by Qualcomm

Ipq8173 Firmware by Qualcomm

Ipq8174 Firmware by Qualcomm

Ipq9554 Firmware by Qualcomm

Ipq9570 Firmware by Qualcomm

Ipq9574 Firmware by Qualcomm

Mdm9250 Firmware by Qualcomm

Pmp8074 Firmware by Qualcomm

Qam8255p Firmware by Qualcomm

Qam8295p Firmware by Qualcomm

Qam8650p Firmware by Qualcomm

Qam8775p Firmware by Qualcomm

Qamsrv1h Firmware by Qualcomm

Qamsrv1m Firmware by Qualcomm

Qca0000 Firmware by Qualcomm

Qca4024 Firmware by Qualcomm

Qca6174a Firmware by Qualcomm

Qca6310 Firmware by Qualcomm

Qca6320 Firmware by Qualcomm

Qca6335 Firmware by Qualcomm

Qca6391 Firmware by Qualcomm

Qca6420 Firmware by Qualcomm

Qca6421 Firmware by Qualcomm

Qca6426 Firmware by Qualcomm

Qca6430 Firmware by Qualcomm

Qca6431 Firmware by Qualcomm

Qca6436 Firmware by Qualcomm

Qca6564a Firmware by Qualcomm

Qca6564au Firmware by Qualcomm

Qca6574 Firmware by Qualcomm

Qca6574a Firmware by Qualcomm

Qca6574au Firmware by Qualcomm

Qca6584au Firmware by Qualcomm

Qca6595 Firmware by Qualcomm