Security readout for executives and security teams
Plain-English summary
Qualcomm disclosed a high-severity flaw in many Snapdragon platforms. A malformed certificate chain handled during SSL or Internet key exchange could trigger an out-of-bounds read. The main business concern is possible exposure of sensitive data from affected embedded, mobile, IoT, automotive, or connectivity products running unpatched firmware.
Executive priority
Prioritize inventory and firmware validation, especially for embedded or managed devices with network-facing SSL or IKE functions. This is high severity, but the provided evidence does not confirm active exploitation.
Technical view
CVE-2021-35083 is an out-of-bounds read caused by improper certificate chain validation in SSL or IKE. CVSS 3.1 is 8.2: network-accessible, low complexity, no privileges, no user interaction, unchanged scope, high confidentiality impact, no integrity impact, and low availability impact.
Likely exposure
Exposure depends on whether products use affected Qualcomm Snapdragon chipsets and affected SSL or IKE certificate validation paths. The source lists many Snapdragon Auto, Compute, Connectivity, Consumer IoT, Industrial IoT, Mobile, Voice & Music, and Wearables components, so asset-to-chipset mapping is essential.
Exploitation context
The provided data does not show CISA KEV listing or cited evidence of active exploitation. Sources do not describe exploit maturity or attack details. Treat this as a remotely reachable firmware-level risk where affected devices process untrusted certificate chains.
Researcher notes
The affected version list is broad and partially truncated in the bundle. Product exposure should be validated through chipset identifiers, OEM firmware advisories, and device SBOMs. The source data names the bug class and impact but does not provide detailed root-cause or patch mechanics.
Mitigation direction
- Review Qualcomm’s June 2022 bulletin and applicable OEM security advisories.
- Update affected device firmware through the device vendor or OEM channel.
- Prioritize externally reachable, safety-critical, or high-data-value Snapdragon-based devices.
- Restrict unnecessary SSL or IKE exposure until vendor remediation is confirmed.
- Track vendor responses for products using affected Qualcomm chipsets.
Validation and detection
- Map deployed hardware SKUs to Qualcomm chipset identifiers listed for CVE-2021-35083.
- Check current firmware versions against Qualcomm and OEM advisory guidance.
- Confirm whether SSL or IKE functionality is enabled on affected products.
- Verify network exposure for impacted services and restrict unnecessary reachability.
- Document devices with no available vendor update for risk acceptance or replacement review.
Public sources used
Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.
Conservative CVE-to-ATT&CK context
These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.
ATT&CK lookup starting points
Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.
CVE-2021-35083 mapping review
Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.
Open ATT&CK lookup- Severity
- High
- CVSS
- 8.2 (3.1)
- Known Exploited
- No
- Published
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:L
CNA and ADP enrichment extracted from CVE v5
These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.
CVSS vector scores
1 official scoreWe collect every scored CVSS vector available in the official CNA and ADP containers. When more than one version is present, the table keeps the source vectors side by side instead of collapsing them into the highest score.
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:L3.94.2Primary CVE scoreVulnerability scoring details
Base CVSS 3.1 score
8.2HighVector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:L
Source materials
- CVE List V5 sourceCVE List V5
- https://www.qualcomm.com/company/product-security/bulletins/june-2022-bulletinCVE reference · x_refsource_CONFIRM
Products and packages named in the record
CWE details
CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.