CVE-2024-49847
📋 TL;DR
This vulnerability allows attackers to cause a denial-of-service condition in Qualcomm devices by sending specially crafted registration acceptance OTA messages with incorrect ciphering key data. It affects mobile devices and infrastructure equipment using vulnerable Qualcomm chipsets. The attack disrupts normal device operation temporarily.
💻 Affected Systems
- Qualcomm mobile platforms
- Qualcomm infrastructure equipment
📦 What is this software?
Snapdragon 8 Gen 3 Mobile Firmware by Qualcomm
View all CVEs affecting Snapdragon 8 Gen 3 Mobile Firmware →
Snapdragon Auto 5g Modem Rf Gen 2 Firmware by Qualcomm
View all CVEs affecting Snapdragon Auto 5g Modem Rf Gen 2 Firmware →
Snapdragon Wear 4100\+ Firmware by Qualcomm
Snapdragon X72 5g Modem Rf Firmware by Qualcomm
View all CVEs affecting Snapdragon X72 5g Modem Rf Firmware →
⚠️ Risk & Real-World Impact
Worst Case
Complete service disruption for affected devices, preventing voice calls, data connectivity, and emergency services access until device restart or network re-registration.
Likely Case
Temporary service interruption (transient DOS) affecting specific devices, requiring reconnection to network services.
If Mitigated
Minimal impact with proper network filtering and updated firmware preventing malicious OTA messages from reaching devices.
🎯 Exploit Status
Exploitation requires ability to send OTA messages to target devices, typically requiring network access to mobile infrastructure
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: Refer to Qualcomm May 2025 security bulletin for specific patched versions
Vendor Advisory: https://docs.qualcomm.com/product/publicresources/securitybulletin/may-2025-bulletin.html
Restart Required: Yes
Instructions:
1. Check Qualcomm advisory for affected chipset versions. 2. Obtain firmware updates from device manufacturer. 3. Apply patches through standard OTA update mechanisms. 4. Verify patch installation and restart devices.
🔧 Temporary Workarounds
Network filtering
allFilter malicious OTA registration messages at network perimeter
Access control
allRestrict OTA message sources to trusted network elements only
🧯 If You Can't Patch
- Implement network monitoring for abnormal OTA message patterns
- Isolate vulnerable devices in separate network segments with restricted OTA message sources
🔍 How to Verify
Check if Vulnerable:
Check device firmware version against Qualcomm advisory; monitor for unexpected service disruptions after OTA registration messagesCheck Version:
Device-specific commands vary by manufacturer; typically: adb shell getprop ro.build.version.security_patch (Android) or manufacturer-specific firmware checkVerify Fix Applied:
Verify firmware version matches patched version in Qualcomm bulletin; test OTA registration processing📡 Detection & Monitoring
Log Indicators:
- Unexpected device reboots
- Failed registration attempts
- OTA message processing errors
Network Indicators:
- Abnormal OTA message patterns
- Multiple registration requests from single source
- Malformed ciphering key data in OTA messages
SIEM Query:
search 'OTA registration' AND (error OR failure OR reboot) within 5 minutes