CVE-2024-23362

Q: What is the severity of CVE-2024-23362?

CVE-2024-23362 has a CVSS score of 7.1 (HIGH). This vulnerability involves a cryptographic issue in RSA key parsing in COBR format, potentially allowing attackers to bypass cryptographic protections or cause denial of service. It affects systems using Qualcomm components that process RSA keys in COBR format. The impact depends on how the vulnerable component is integrated into the system.

7.1 HIGH

📋 TL;DR

This vulnerability involves a cryptographic issue in RSA key parsing in COBR format, potentially allowing attackers to bypass cryptographic protections or cause denial of service. It affects systems using Qualcomm components that process RSA keys in COBR format. The impact depends on how the vulnerable component is integrated into the system.

💻 Affected Systems

Products:

Qualcomm chipsets and components

Versions: Specific versions listed in Qualcomm September 2024 security bulletin

Operating Systems: Android and other OS using Qualcomm components

Default Config Vulnerable: ⚠️ Yes

Notes: Affects systems using RSA keys in COBR format; impact varies by implementation.

📦 What is this software?

⚠️ Risk & Real-World Impact

🔴

Worst Case

Complete compromise of cryptographic protections, allowing decryption of sensitive data, authentication bypass, or system compromise.

🟠

Likely Case

Denial of service through malformed key processing or potential cryptographic bypass in specific configurations.

🟢

If Mitigated

Limited impact if proper input validation and cryptographic controls are implemented at higher layers.

🌐 Internet-Facing: MEDIUM - Could affect internet-facing services using vulnerable cryptographic implementations, but requires specific conditions.

🏢 Internal Only: LOW - Primarily affects internal cryptographic operations; less exposure to external attackers.

🎯 Exploit Status

Public PoC: ✅ No

Weaponized: UNKNOWN

Unauthenticated Exploit: ✅ No

Complexity: MEDIUM

Exploitation requires ability to supply malformed RSA keys; complexity depends on system configuration.

🛠️ Fix & Mitigation

✅ Official Fix

Patch Version: Versions specified in Qualcomm September 2024 security bulletin

Vendor Advisory: https://docs.qualcomm.com/product/publicresources/securitybulletin/september-2024-bulletin.html

Restart Required: Yes

Instructions:

1. Check Qualcomm advisory for affected components. 2. Apply firmware/software updates from device manufacturer. 3. Reboot affected devices. 4. Verify update installation.

🔧 Temporary Workarounds

Input validation for RSA keys

all

Implement strict validation of RSA keys before processing

Disable COBR format support

all

If possible, disable support for COBR format RSA keys

🧯 If You Can't Patch

Implement network segmentation to isolate vulnerable systems
Monitor for anomalous cryptographic operations or key processing errors

🔍 How to Verify

Check if Vulnerable:

Check device firmware version against Qualcomm advisory; examine cryptographic library versions

Check Version:

Device-specific commands (e.g., 'getprop ro.build.fingerprint' for Android)

Verify Fix Applied:

Verify firmware/software version matches patched versions in advisory; test RSA key processing

📡 Detection & Monitoring

Log Indicators:

Cryptographic library errors
RSA key parsing failures
Unexpected key format rejections

Network Indicators:

Unusual cryptographic handshake failures
Anomalous key exchange patterns

SIEM Query:

Search for cryptographic error logs containing 'RSA', 'COBR', or 'key parsing'

📊 Metadata

CVE ID: CVE-2024-23362

CVSS v3 Score: 7.1 (HIGH)

CVSS Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N

CWE: CWE-20

Published: September 2, 2024

Last Updated: October 3, 2025

🔗 References

https://docs.qualcomm.com/product/publicresources/securitybulletin/september-2024-bulletin.html Vendor Advisory

📋 TL;DR

💻 Affected Systems

📦 What is this software?

9205 Lte Modem Firmware by Qualcomm

Aqt1000 Firmware by Qualcomm

Ar8031 Firmware by Qualcomm

Ar8035 Firmware by Qualcomm

Csra6620 Firmware by Qualcomm

Csra6640 Firmware by Qualcomm

Fastconnect 6200 Firmware by Qualcomm

Fastconnect 6700 Firmware by Qualcomm

Fastconnect 6800 Firmware by Qualcomm

Fastconnect 6900 Firmware by Qualcomm

Fastconnect 7800 Firmware by Qualcomm

Flight Rb5 5g Platform Firmware by Qualcomm

Qam8255p Firmware by Qualcomm

Qam8295p Firmware by Qualcomm

Qam8620p Firmware by Qualcomm

Qam8650p Firmware by Qualcomm

Qam8775p Firmware by Qualcomm

Qamsrv1h Firmware by Qualcomm

Qamsrv1m Firmware by Qualcomm

Qca4004 Firmware by Qualcomm

Qca6174a Firmware by Qualcomm

Qca6310 Firmware by Qualcomm

Qca6320 Firmware by Qualcomm

Qca6335 Firmware by Qualcomm

Qca6391 Firmware by Qualcomm

Qca6420 Firmware by Qualcomm

Qca6421 Firmware by Qualcomm

Qca6426 Firmware by Qualcomm

Qca6430 Firmware by Qualcomm

Qca6431 Firmware by Qualcomm

Qca6436 Firmware by Qualcomm

Qca6564a Firmware by Qualcomm

Qca6564au Firmware by Qualcomm

Qca6574 Firmware by Qualcomm

Qca6574a Firmware by Qualcomm

Qca6574au Firmware by Qualcomm

Qca6584au Firmware by Qualcomm

Qca6595 Firmware by Qualcomm

Qca6595au Firmware by Qualcomm

Qca6678aq Firmware by Qualcomm

Qca6696 Firmware by Qualcomm

Qca6698aq Firmware by Qualcomm

Qca6797aq Firmware by Qualcomm

Qca8081 Firmware by Qualcomm

Qca8337 Firmware by Qualcomm

Qca9377 Firmware by Qualcomm

Qca9984 Firmware by Qualcomm

Qcc710 Firmware by Qualcomm

Qcm2290 Firmware by Qualcomm

Qcm4290 Firmware by Qualcomm

Qcm4490 Firmware by Qualcomm

Qcm5430 Firmware by Qualcomm

Qcm6490 Firmware by Qualcomm

Qcm8550 Firmware by Qualcomm

Qcn6024 Firmware by Qualcomm

Qcn6224 Firmware by Qualcomm

Qcn6274 Firmware by Qualcomm

Qcn7606 Firmware by Qualcomm

Qcn9011 Firmware by Qualcomm

Qcn9012 Firmware by Qualcomm

Qcn9024 Firmware by Qualcomm

Qcs2290 Firmware by Qualcomm

Qcs4290 Firmware by Qualcomm

Qcs4490 Firmware by Qualcomm

Qcs5430 Firmware by Qualcomm

Qcs6490 Firmware by Qualcomm

Qcs7230 Firmware by Qualcomm

Qcs8250 Firmware by Qualcomm

Qcs8550 Firmware by Qualcomm

Qdu1000 Firmware by Qualcomm

Qdu1010 Firmware by Qualcomm

Qdu1110 Firmware by Qualcomm

Qdu1210 Firmware by Qualcomm

Qdx1010 Firmware by Qualcomm

Qdx1011 Firmware by Qualcomm

Qep8111 Firmware by Qualcomm

Qfw7114 Firmware by Qualcomm