Skip to content
Fencer Vulns
high 7.5

CVE-2022-25735 json

Null Pointer Dereference in MODEM

published 2023-02-09 3 y ago modified 2026-06-17 4 mo ago also EUVD-2022-30390

cvss
7.5
version 3.1, CNA
cisa kev
Not listed
not in CISA's catalog
epss
0.4%
EPSS 0.4% chance of exploitation in 30 days, percentile 35%
public exploits
0
none known

Summary

Denial of service in modem due to missing null check while processing TCP or UDP packets from server

CISA SSVC

Exploitation
none
Automatable
yes
Technical impact
partial
Assessed
2 y ago

Exploit prediction

0.41% chance of exploitation in the next 30 days, higher than 35% of all scored CVEs (FIRST EPSS, 2026-11-08).

CVSS scores

assigned by version score vector
CNA 3.1 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
NVD 3.1 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Affected products

  • Qualcomm, Inc. Snapdragon
  • qualcomm ar8031_firmware
  • qualcomm csra6620_firmware
  • qualcomm csra6640_firmware
  • qualcomm mdm8207_firmware
  • qualcomm mdm9205_firmware
  • qualcomm mdm9206_firmware
  • qualcomm mdm9207_firmware
  • qualcomm mdm9607_firmware
  • qualcomm qca4004_firmware
  • qualcomm qca4020_firmware
  • qualcomm qca4024_firmware
  • qualcomm qcs405_firmware
  • qualcomm qts110_firmware
  • qualcomm ssg2115p_firmware
  • qualcomm ssg2125p_firmware
  • qualcomm sxr1230p_firmware
  • qualcomm sxr2230p_firmware
  • qualcomm wcd9306_firmware
  • qualcomm wcd9330_firmware
  • qualcomm wcd9335_firmware
  • qualcomm wcd9380_firmware
  • qualcomm wcd9385_firmware
  • qualcomm wcn3980_firmware
  • qualcomm wcn3998_firmware
  • qualcomm wcn3999_firmware
  • qualcomm wcn6855_firmware
  • qualcomm wcn6856_firmware
  • qualcomm wcn7850_firmware
  • qualcomm wcn7851_firmware
  • qualcomm wsa8810_firmware
  • qualcomm wsa8815_firmware
  • qualcomm wsa8830_firmware
  • qualcomm wsa8832_firmware
  • qualcomm wsa8835_firmware

Classification

Weakness

References

Sources

Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.