LiveActive security incident?Get immediate response
CVE Record

CVE-2020-3704: u'While processing invalid connection request PDU which is nonstandard (interval or timeout is 0) from cent...

u'While processing invalid connection request PDU which is nonstandard (interval or timeout is 0) from central device may lead peripheral system enter into dead lock state.(This CVE is equivalent to InvalidConnectionRequest(CVE-2019-19193) mentioned in sweyntooth paper)' in Snapdragon Auto, Snapdragon Compute, Snapdragon Connectivity, Snapdragon Consumer Electronics Connectivity, Snapdragon Consumer IOT, Snapdragon Industrial IOT, Snapdragon IoT, Snapdragon Mobile, Snapdragon Voice & Music, Snapdragon Wired Infrastructure and Networking in Agatti, APQ8009, APQ8017, APQ8053, AR9344, Bitra, IPQ5018, Kamorta, MDM9607, MDM9640, MDM9650, MSM8996AU, Nicobar, QCA6174A, QCA6390, QCA6574AU, QCA9377, QCA9886, QCM6125, QCN7605, QCS404, QCS405, QCS605, QCS610, QRB5165, Rennell, SA415M, SA515M, Saipan, SC7180, SC8180X, SDA845, SDM660, SDM670, SDM710, SDM845, SDM850, SDX20, SDX24, SDX55, SM6150, SM7150, SM8150, SM8250, SXR1130, SXR2130

UnknownCVSS not scoredNot KEV-listedUpdated
Discuss exposureBack to CVEs
Glexia's TakeAutomated analysismoderate

Security readout for executives and security teams

Plain-English summary

CVE-2020-3704 is a Qualcomm Snapdragon issue where malformed connection request handling may cause a peripheral system deadlock. In business terms, affected devices could become unavailable until recovered. The source bundle does not provide CVSS, fixed versions, or evidence of active exploitation.

Executive priority

Treat this as an availability risk across Qualcomm-based embedded and mobile estates. Prioritize high-impact operational devices first, especially where outage recovery is difficult. Urgency is moderate unless internal exposure or vendor guidance shows critical service dependence.

Technical view

The CVE describes processing of a nonstandard invalid connection request PDU with interval or timeout set to 0 from a central device. On listed Snapdragon platforms, this may lead the peripheral system into a deadlock state. Qualcomm states it is equivalent to SweynTooth InvalidConnectionRequest CVE-2019-19193.

Likely exposure

Exposure depends on whether products use the listed Qualcomm Snapdragon chipsets or platform families and expose the affected peripheral behavior. The affected list spans auto, compute, connectivity, IoT, mobile, voice and music, and wired infrastructure categories.

Exploitation context

The provided sources do not show CISA KEV listing or active exploitation. The issue appears denial-of-service oriented rather than data theft. The malformed central-to-peripheral request context suggests wireless/local protocol reachability, but the bundle does not define exploit prerequisites.

Researcher notes

Evidence is limited to the CVE description, affected Qualcomm platform list, and Qualcomm bulletin reference. No CVSS, CWE, exploit details, or fixed firmware versions are included in the supplied bundle. Avoid claiming exploitation or specific exploitability beyond invalid PDU deadlock behavior.

Mitigation direction

  • Check Qualcomm's October 2020 bulletin for vendor guidance and affected chipset handling.
  • Obtain firmware or security updates from the device OEM or module vendor.
  • Prioritize devices where availability loss creates safety or operational impact.
  • Limit unnecessary Bluetooth or peripheral exposure where operationally acceptable.
  • Track compensating controls until OEM patch status is confirmed.

Validation and detection

  • Inventory devices and modules using the listed Qualcomm platform identifiers.
  • Map each asset to OEM firmware versions and security bulletin coverage.
  • Confirm whether the device exposes the relevant peripheral connection behavior.
  • Check vulnerability management records for CVE-2020-3704 or Qualcomm October 2020 coverage.
  • Verify remediation through OEM release notes, not assumed chipset names alone.
Prepared
Confidence
medium
Sources
3

Public sources used

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.

Potential ATT&CK relevance

Conservative CVE-to-ATT&CK context

These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.

ATT&CK lookup starting points

Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.

cve · low confidence lookup

CVE-2020-3704 mapping review

Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.

Open ATT&CK lookup
Vulnerability profileCVE Program record
Severity
Unknown
CVSS
Not scored
Known Exploited
No
Published
Official CVE source material

CNA and ADP enrichment extracted from CVE v5

These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.

0CVSS vectors
0Timeline events
0ADP providers
2Source links

CVSS and timeline data

No CVSS vectors or timeline events were available in the normalized CVE source material.

Source materials

Affected products

Products and packages named in the record

VendorProductVersion / packageStatus
Qualcomm, Inc.Snapdragon Auto, Snapdragon Compute, Snapdragon Connectivity, Snapdragon Consumer Electronics Connectivity, Snapdragon Consumer IOT, Snapdragon Industrial IOT, Snapdragon IoT, Snapdragon Mobile, Snapdragon Voice & Music, Snapdragon Wired Infrastructure and NetworkingAgatti, APQ8009, APQ8017, APQ8053, AR9344, Bitra, IPQ5018, Kamorta, MDM9607, MDM9640, MDM9650, MSM8996AU, Nicobar, QCA6174A, QCA6390, QCA6574AU, QCA9377, QCA9886, QCM6125, QCN7605, QCS404, QCS405, QCS605, QCS610, QRB5165, Rennell, SA415M, SA515M, Saipan, SC7180, SC8180X, SDA845, SDM660, SDM670, SDM710, SDM845, SDM850, SDX20, SDX24, SDX55, SM6150, SM7150, SM8150, SM8250, SXR1130, SXR2130Listed
Weakness

CWE details

No CWE listed

CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.