LiveActive security incident?Get immediate response
CVE Record

CVE-2021-35116: APK can load a crafted model into the CDSP which can lead to a compromise of CDSP and other APK`s data exec...

APK can load a crafted model into the CDSP which can lead to a compromise of CDSP and other APK`s data executing there in Snapdragon Auto, Snapdragon Compute, Snapdragon Connectivity, Snapdragon Consumer IOT, Snapdragon Industrial IOT, Snapdragon Mobile, Snapdragon Wearables

HighCVSS 7.7Not KEV-listedUpdated
Discuss exposureBack to CVEs
Glexia's TakeAutomated analysishigh

Security readout for executives and security teams

Plain-English summary

CVE-2021-35116 affects many Qualcomm Snapdragon platforms. A local APK can load a crafted model into the CDSP, potentially compromising that processor context and data from other APKs running there. The business risk is highest for managed mobile, IoT, automotive, wearable, and embedded fleets using affected Snapdragon chipsets.

Executive priority

Treat as a high-priority supply-chain firmware issue for affected fleets, especially embedded, mobile, automotive, and IoT devices. Urgency depends on asset presence and OEM patch availability, not just the CVE score.

Technical view

The source describes a local, low-complexity issue where an APK can submit a crafted model to the Qualcomm CDSP. Impact is high confidentiality and integrity compromise, with no availability impact stated. The bundle lists many affected Qualcomm part numbers across Snapdragon Auto, Compute, Connectivity, IoT, Mobile, and Wearables.

Likely exposure

Exposure depends on whether products contain one of the listed Qualcomm Snapdragon parts and accept APK execution that can interact with CDSP functionality. CPE data is absent, so device-by-device OEM mapping is required.

Exploitation context

The CVE is not listed as CISA KEV in the bundle, and no cited source states active exploitation. The CVSS vector is local, no privileges, no user interaction, suggesting risk from malicious or untrusted APKs on affected devices.

Researcher notes

The bundle provides no CWE, CPEs, exploit narrative, or fixed firmware versions. Analysis should stay anchored to Qualcomm and OEM advisories. Validation requires hardware mapping because the affected list is chipset-focused, not product-model-focused.

Mitigation direction

  • Check Qualcomm May 2022 bulletin and OEM advisories for CVE-2021-35116 guidance.
  • Apply OEM firmware or security updates that include the relevant Qualcomm fixes.
  • Inventory managed devices for the listed Snapdragon part numbers.
  • Limit installation of untrusted APKs on affected managed devices.
  • Prioritize embedded and long-lived fleets where firmware updates lag.

Validation and detection

  • Map device models and BOMs to the affected Qualcomm part list.
  • Confirm OEM firmware includes Qualcomm May 2022 bulletin fixes or later guidance.
  • Review MDM or EDR inventory for unknown APKs on affected devices.
  • Track exceptions where vendors have not published device-specific updates.
Prepared
Confidence
medium
Sources
3

Public sources used

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.

Potential ATT&CK relevance

Conservative CVE-to-ATT&CK context

These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.

ATT&CK lookup starting points

Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.

cve · low confidence lookup

CVE-2021-35116 mapping review

Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.

Open ATT&CK lookup
Vulnerability profileCVE Program record
Severity
High
CVSS
7.7 (3.1)
Known Exploited
No
Published

Vector: CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N

Official CVE source material

CNA and ADP enrichment extracted from CVE v5

These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.

1CVSS vectors
0Timeline events
0ADP providers
2Source links

CVSS vector scores

1 official score

We collect every scored CVSS vector available in the official CNA and ADP containers. When more than one version is present, the table keeps the source vectors side by side instead of collapsing them into the highest score.

ScoreVersionSeverityVectorExploitImpactSource
7.7CVSS 3.1HighCVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N2.55.2Primary CVE score

Vulnerability scoring details

Base CVSS 3.1 score

7.7High
CVSS 3.1 vector shape for CVE-2021-35116Attack VectorAttack ComplexityPrivileges RequiredUser InteractionScopeConfidentiality ImpactIntegrity ImpactAvailability Impact

Vector: CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N

Attack Vector
NetworkAdjacentLocalPhysical
Attack Complexity
LowHigh
Privileges Required
NoneLowHigh
User Interaction
NoneRequired
Scope
ChangedUnchanged
Confidentiality Impact
HighLowNone
Integrity Impact
HighLowNone
Availability Impact
HighLowNone

Source materials

Affected products

Products and packages named in the record

VendorProductVersion / packageStatus
Qualcomm, Inc.Snapdragon Auto, Snapdragon Compute, Snapdragon Connectivity, Snapdragon Consumer IOT, Snapdragon Industrial IOT, Snapdragon Mobile, Snapdragon WearablesAPQ8009, APQ8009W, APQ8096AU, AQT1000, CSRB31024, MDM9607, MDM9626, MDM9628, MDM9640, MSM8909W, MSM8937, MSM8996AU, PM8937, QCA6174A, QCA6310, QCA6320, QCA6390, QCA6391, QCA6420, QCA6430, QCA6564A, QCA6564AU, QCA6574, QCA6574A, QCA6574AU, QCA6595AU, QCA6696, QCA9377, QCM2290, QCM4290, QCM6490, QCS2290, QCS4290, QCS603, QCS605, QCS6490, SA415M, SA6155, SA6155P, SA8155, SA8155P, SA8195P, SD 675, SD 8 Gen1 5G, SD429, SD460, SD480, SD660, SD662, SD665, SD675, SD678, SD680, SD690 5G, SD695, SD720G, SD730, SD750G, SD765, SD765G, SD768G, SD778G, SD780G, SD820, SD835, SD855, SD865 5G, SD870, SD888, SD888 5G, SDM429W, SDW2500, SDX12, SDX50M, SDX55, SDX55M, SDX65, SM4125, SM6250, SM7250P, SM7315, SM7325P, WCD9326, WCD9335, WCD9340, WCD9341, WCD9370, WCD9375, WCD9380, WCD9385, WCN3610, WCN3615, WCN3620, WCN3660B, WCN3910, WCN3950, WCN3980, WCN3988, WCN3990, WCN3991, WCN3998, WCN6740, WCN6750, WCN6850, WCN6851, WCN6855, WCN6856, WCN7850, WCN7851, WSA8810, WSA8815, WSA8830, WSA8835Listed
Weakness

CWE details

No CWE listed

CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.