LiveActive security incident?Get immediate response
CVE Record

CVE-2021-35122: Non-secure region can try modifying RG permissions of IO space xPUs due to improper input validation in Sna...

Non-secure region can try modifying RG permissions of IO space xPUs due to improper input validation in Snapdragon Auto, Snapdragon Compute, Snapdragon Connectivity, Snapdragon Consumer IOT, Snapdragon Industrial IOT, Snapdragon Mobile, Snapdragon Wearables

CriticalCVSS 9.3Not KEV-listedUpdated
Discuss exposureBack to CVEs
Glexia's TakeAutomated analysiscritical

Security readout for executives and security teams

Plain-English summary

This is a critical Qualcomm Snapdragon firmware-class issue affecting many mobile, compute, IoT, automotive, wearable, connectivity, and audio components. A local attacker context could affect protected IO permission boundaries, with potential impact to confidentiality, integrity, and availability. The provided sources do not show known active exploitation.

Executive priority

Treat this as high-priority for affected fleets because the potential impact is broad and severe. Urgency depends on whether your environment contains listed Qualcomm components and whether OEM firmware fixes are available and deployed.

Technical view

CVE-2021-35122 stems from improper input validation where a non-secure region can attempt to modify resource-group permissions for IO-space xPUs. The CVSS 3.1 score is 9.3 with local attack vector, low complexity, no privileges, no user interaction, changed scope, and high CIA impact.

Likely exposure

Exposure is likely in devices or products using the listed Qualcomm Snapdragon and related components. Organizations usually need OEM firmware, chipset bill-of-materials, mobile device management, or embedded device inventory to confirm whether affected parts are present.

Exploitation context

The source bundle marks KEV as false and provides no cited evidence of active exploitation. The vulnerability is local, so practical abuse would require attacker code or local access on an affected device. Public sources here do not describe exploit availability.

Researcher notes

No CWE is provided in the source bundle. Validation should focus on component identification, firmware lineage, and OEM bulletin correlation. Avoid assuming exploitability beyond the CVSS vector and Qualcomm description without device-specific analysis.

Mitigation direction

  • Check Qualcomm’s July 2022 security bulletin and OEM advisories for applicable fixes.
  • Apply vendor or OEM firmware updates that include the Qualcomm remediation.
  • Prioritize managed mobile, IoT, automotive, wearable, and edge devices with listed components.
  • Restrict untrusted local code execution on affected device classes where feasible.
  • Track unsupported products that cannot receive OEM firmware updates.

Validation and detection

  • Inventory hardware against the affected Qualcomm part list in the CVE source bundle.
  • Verify firmware or security patch level against OEM guidance referencing Qualcomm July 2022 fixes.
  • Confirm mobile and embedded fleets include Snapdragon Auto, Compute, Connectivity, IoT, Mobile, and Wearables coverage.
  • Review exceptions for devices without available vendor patches or lifecycle support.
Prepared
Confidence
medium
Sources
3

Public sources used

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.

Potential ATT&CK relevance

Conservative CVE-to-ATT&CK context

These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.

ATT&CK lookup starting points

Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.

cve · low confidence lookup

CVE-2021-35122 mapping review

Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.

Open ATT&CK lookup
Vulnerability profileCVE Program record
Severity
Critical
CVSS
9.3 (3.1)
Known Exploited
No
Published

Vector: CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H

Official CVE source material

CNA and ADP enrichment extracted from CVE v5

These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.

1CVSS vectors
0Timeline events
0ADP providers
2Source links

CVSS vector scores

1 official score

We collect every scored CVSS vector available in the official CNA and ADP containers. When more than one version is present, the table keeps the source vectors side by side instead of collapsing them into the highest score.

ScoreVersionSeverityVectorExploitImpactSource
9.3CVSS 3.1CriticalCVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H2.56Primary CVE score

Vulnerability scoring details

Base CVSS 3.1 score

9.3Critical
CVSS 3.1 vector shape for CVE-2021-35122Attack VectorAttack ComplexityPrivileges RequiredUser InteractionScopeConfidentiality ImpactIntegrity ImpactAvailability Impact

Vector: CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H

Attack Vector
NetworkAdjacentLocalPhysical
Attack Complexity
LowHigh
Privileges Required
NoneLowHigh
User Interaction
NoneRequired
Scope
ChangedUnchanged
Confidentiality Impact
HighLowNone
Integrity Impact
HighLowNone
Availability Impact
HighLowNone

Source materials

Affected products

Products and packages named in the record

VendorProductVersion / packageStatus
Qualcomm, Inc.Snapdragon Auto, Snapdragon Compute, Snapdragon Connectivity, Snapdragon Consumer IOT, Snapdragon Industrial IOT, Snapdragon Mobile, Snapdragon WearablesAQT1000, AR8035, QCA6390, QCA6391, QCA6420, QCA6421, QCA6426, QCA6430, QCA6431, QCA6436, QCA6574A, QCA6574AU, QCA6595AU, QCA6696, QCA8081, QCA8337, QCM2290, QCM4290, QCM6490, QCS2290, QCS410, QCS4290, QCS610, QCS6490, QRB5165, QRB5165M, QRB5165N, QSM8350, SA515M, SA8540P, SA9000P, SD 675, SD 8CX, SD 8cx Gen2, SD 8cx Gen3, SD429, SD460, SD480, SD662, SD675, SD678, SD680, SD690 5G, SD695, SD720G, SD730, SD750G, SD765, SD765G, SD768G, SD778G, SD780G, SD7c, SD855, SD865 5G, SD870, SD888, SD888 5G, SDM429W, SDX50M, SDX55, SDX55M, SDX65, SDXR2 5G, SM4125, SM6250, SM6250P, SM7250P, SM7315, SM7325P, SW5100, SW5100P, WCD9340, WCD9341, WCD9360, WCD9370, WCD9371, WCD9375, WCD9380, WCD9385, WCN3620, WCN3660B, WCN3910, WCN3950, WCN3980, WCN3988, WCN3990, WCN3991, WCN3998, WCN6740, WCN6750, WCN6850, WCN6851, WCN6855, WCN6856, WCN7850, WCN7851, WSA8810, WSA8815, WSA8830, WSA8835Listed
Weakness

CWE details

No CWE listed

CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.