Security readout for executives and security teams
Plain-English summary
CVE-2021-35109 is a Qualcomm Snapdragon issue where address ranges may be manipulated during secure-side configuration. The impact can be serious on affected devices, but the published CVSS vector requires physical access, which limits broad remote exposure.
Executive priority
Treat as moderate priority. The potential device impact is high, but physical-access requirements reduce enterprise-wide urgency compared with remotely exploitable mobile flaws. Prioritize high-risk fleets and devices handling sensitive data.
Technical view
Qualcomm describes possible address manipulation from APP-NS while APP-S configures an RG and merges address ranges. Affected products are Snapdragon Connectivity and Snapdragon Mobile components listed by Qualcomm. CVSS 3.1 is 6.8 with high confidentiality, integrity, and availability impact, but AV:P.
Likely exposure
Exposure is limited to devices using the listed Qualcomm components, including SD 8 Gen1 5G, SM7450, SM8475 variants, WCD937x/WCD938x, WCN6750/WCN685x/WCN7851, and WSA883x parts. Asset owners need chipset-level inventory or OEM confirmation.
Exploitation context
The provided bundle does not show active exploitation. KEV is false. The CVSS vector indicates physical access, no privileges, no user interaction, and low attack complexity, so stolen, lab-accessible, or physically exposed devices carry the most relevant risk.
Researcher notes
Public technical detail is sparse. Do not assume exploitability beyond Qualcomm’s description and the CVSS vector. Focus validation on affected component presence, OEM patch status, and whether physical access risk changes the operational priority.
Mitigation direction
- Review Qualcomm August 2022 bulletin for vendor guidance.
- Check device OEM firmware advisories for affected models.
- Apply applicable OEM firmware or security updates.
- Prioritize managed devices with listed Snapdragon components.
- Strengthen controls for lost or physically exposed devices.
Validation and detection
- Map deployed devices to Qualcomm chipsets and components.
- Compare firmware patch levels against OEM security bulletins.
- Confirm whether each model contains listed affected parts.
- Track exceptions where OEM updates are unavailable.
- Monitor Qualcomm and OEM advisories for revised guidance.
Public sources used
Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.
Conservative CVE-to-ATT&CK context
These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.
ATT&CK lookup starting points
Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.
CVE-2021-35109 mapping review
Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.
Open ATT&CK lookup- Severity
- Medium
- CVSS
- 6.8 (3.1)
- Known Exploited
- No
- Published
Vector: CVSS:3.1/AV:P/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
CNA and ADP enrichment extracted from CVE v5
These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.
CVSS vector scores
1 official scoreWe collect every scored CVSS vector available in the official CNA and ADP containers. When more than one version is present, the table keeps the source vectors side by side instead of collapsing them into the highest score.
CVSS:3.1/AV:P/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H0.95.9Primary CVE scoreVulnerability scoring details
Base CVSS 3.1 score
6.8MediumVector: CVSS:3.1/AV:P/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Source materials
- CVE List V5 sourceCVE List V5
- https://www.qualcomm.com/company/product-security/bulletins/august-2022-bulletinCVE reference · x_refsource_CONFIRM
Products and packages named in the record
CWE details
CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.