dbcve.org
Debian LinuxOperating system · Debian

CVE-2020-3702

MEDIUM · 6.5 CVSS v3.1 Published 2020-09-08
Mitigation only
No fix yet — a mitigation exists. There is no fixed release. A documented workaround reduces exposure in the meantime.
See remediation →
70/100
Remediation priority · Elevated
No privileges Zero-click

Official description Straight from the sourceThe vendor's or NVD's own wording, published unedited. Authoritative, but often terse — it says what broke, rarely what to do.

NVD · unedited
u'Specifically timed and handcrafted traffic can cause internal errors in a WLAN device that lead to improper layer 2 Wi-Fi encryption with a consequent possibility of information disclosure over the air for a discrete set of traffic' in Snapdragon Auto, Snapdragon Compute, Snapdragon Connectivity, Snapdragon Consumer IOT, Snapdragon Industrial IOT, Snapdragon Mobile, Snapdragon Voice & Music, Snapdragon Wearables, Snapdragon Wired Infrastructure and Networking in APQ8053, IPQ4019, IPQ8064, MSM8909W, MSM8996AU, QCA9531, QCN5502, QCS405, SDX20, SM6150, SM7150

Technical summary Written by usOur analysis, written from the advisory, the CVSS vector and the affected-version data. It adds context the advisory leaves out, and never invents facts that are not in the source.

dbcve analysis · high confidence

A vulnerability in Qualcomm WLAN firmware allows specially timed and crafted network traffic to trigger internal errors that cause improper layer 2 Wi-Fi encryption. This encryption weakness enables potential information disclosure over the air for affected traffic. The issue affects multiple Snapdragon chipset families used across mobile, IoT, compute, automotive, and infrastructure products.

MitigationApply vendor-provided firmware updates from Qualcomm for affected chipsets (APQ8053, IPQ4019, IPQ8064, MSM8909W, MSM8996AU, QCA9531, QCN5502, QCS405, SDX20, SM6150, SM7150). Until patched, monitor Wi-Fi traffic for anomalies and restrict exposure to untrusted networks given the requirement for timing-specific crafted packets.

Verify against the referenced sources before acting — the references below are authoritative for this CVE, this summary is not.

Affected products & versions What the vendor confirmedThe version ranges the vendor confirmed as vulnerable. If your version sits inside a range here, treat yourself as exposed until you have upgraded.

NVD · CPE data
Debian LinuxOperating system
Affected:= 10.0= 9.0
Apq8053 FirmwareOperating system
Affected:all versions
Ipq4019 FirmwareOperating system
Affected:all versions
Ipq8064 FirmwareOperating system
Affected:all versions
Msm8909w FirmwareOperating system
Affected:all versions
Msm8996au FirmwareOperating system
Affected:all versions
Qca9531 FirmwareOperating system
Affected:all versions
Qcn5502 FirmwareOperating system
Affected:all versions

CVSS breakdown How the score is builtThe industry scoring standard. It rates how the flaw is reached, what it takes to exploit, and what an attacker gains — the score is derived from those, not the other way round.

From the vector
Attack vector
Adjacent
Complexity
Low
Privileges
None
User interaction
None
Scope
Unchanged
Confidentiality
High
Integrity
None
Availability
None

CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Am I affected? How to checkSteps we derive from the advisory and the affected-version data, so you can decide whether this CVE reaches your setup. They are a guide, not a scan — your own configuration is the authority.

dbcve checks

Work through these to decide whether this CVE applies to you.

  1. Identify Qualcomm Wi-Fi chipset in use
    Run 'lspci | grep -i network' or 'lspci | grep -i wireless' on Linux systems to list network adapters. For embedded/IoT devices, check '/proc/cpuinfo' or use 'lsusb' if USB wireless adapters are involved. Look for chipset identifiers: APQ8053, IPQ4019, IPQ8064, MSM8909W, MSM8996AU, QCA9531, QCN5502.
    Affected if The system uses any of the listed Qualcomm chipset families (APQ8053, IPQ4019, IPQ8064, MSM8909W, MSM8996AU, QCA9531, QCN5502)
  2. Check Wi-Fi firmware version
    On Linux, check the firmware version loaded for the wireless interface using 'ip link show' to identify the interface (e.g., wlan0), then examine kernel logs with 'dmesg | grep -i firmware' or check '/sys/class/net/wlan0/device/firmware_version' if available. For embedded devices, consult vendor documentation or access the wireless module via serial/SSH and check 'iw list' or 'wlanconfig' commands.
    Affected if The firmware version cannot be determined or is reported as an unpatched build; note that the affected products list indicates 'all versions' are vulnerable, meaning any installed firmware version
  3. Verify Wi-Fi interface is active
    Run 'ip link show' or 'iwconfig' to check if a wireless interface (such as wlan0, wlan1, or similar) exists and is in an 'UP' or 'UNKNOWN' state indicating it is radio-enabled. Also check 'rfkill list' to see if the wireless radio is blocked or unblocked.
    Affected if A Wi-Fi interface exists and is enabled (not rfkilled), meaning the vulnerable WLAN firmware is actively running and capable of processing network traffic
  4. Confirm Debian system has Qualcomm wireless firmware packages
    On Debian 9 or 10 systems, run 'dpkg -l | grep -i firmware' to list installed firmware packages. Specifically search for Qualcomm-related packages using 'dpkg -l | grep -iE 'qualcomm|atheros' (note: QCA9531 is an Atheros chipset rebranded/used with Qualcomm). Check '/lib/firmware/' directory for the presence of firmware files matching the affected chipsets.
    Affected if Debian 9 or 10 is running with Qualcomm or Qualcomm-branded (Atheros) Wi-Fi firmware files present in the system

A system is affected if it contains any of the listed Qualcomm Wi-Fi chipsets (APQ8053, IPQ4019, IPQ8064, MSM8909W, MSM8996AU, QCA9531, QCN5502) and has the Wi-Fi interface enabled, since all firmware versions for these chipsets are vulnerable per the affected products list.

Generated from the published advisory. Verify against your own configuration.

Check your environment

Paste your version and any relevant configuration and it will be compared against the affected criteria above. Do not include secrets or credentials.

AI-assisted, checked against the advisory. Informational, not a guarantee.

Remediation Closing itWhat it takes to close this. Where a vendor fix exists we point at it; where none exists we say so plainly, and can build one. Effort estimates are scoped from the advisory, not from your codebase.

From vendor data
Mitigation available No clean upgrade yet — mitigate in the meantime
Mitigation

Apply vendor-provided firmware updates from Qualcomm for affected chipsets (APQ8053, IPQ4019, IPQ8064, MSM8909W, MSM8996AU, QCA9531, QCN5502, QCS405, SDX20, SM6150, SM7150). Until patched, monitor Wi-Fi traffic for anomalies and restrict exposure to untrusted networks given the requirement for timing-specific crafted packets.

Fix this in Debian Linux Scoped from the published advisory
  • Consultation4.0 h
  • Implementation8.0 h
  • Testing6.0 h
  • Review / QA3.0 h
21.0 hours of engineering $3,680
Get help mitigating

An estimate, not a bill — we confirm scope with you before any work starts. Need it this week? Rush from $5,888.

Scan for this in your stack

Free · runs locally
dbcve dependency scanner

Check whether your project pulls in CVE-2020-3702 — or any other known-vulnerable package — straight from your lock files. Free and open source; it runs locally and uploads nothing.

Get it on GitHub Scan in the browser

References Go to the primary sourcePrimary sources — vendor advisories, patches and trackers. Where our summary and a reference disagree, the reference wins.

Primary sources

Practitioner notes

Contributed

Peer-ranked notes from engineers who’ve handled CVE-2020-3702 in production — separate from our analysis above.

No notes yet

Be the first to add a field note for this CVE — a mitigation you’ve verified, a version caveat, or a link to a working fix. Sign in above to contribute.

What this is

A place for practitioners to share what actually worked: a mitigation you’ve tested, a configuration change, a version- or environment-specific caveat, or a link to a verified patch. The most useful notes rise to the top as peers upvote them, so the signal stays high.

What belongs here
  • Verified mitigations, workarounds, and config changes
  • Version or environment caveats, and links to real fixes
  • No weaponised exploit code, or anything meant to cause harm
  • No spam, self-promotion, credentials, or personal data