CVE-2018-11922

CRITICAL

Published Nov 26, 2024 Modified Jan 9, 2025 CWE-16

Description

Wrong configuration in Touch Pal application can collect user behavior data without awareness by the user.

Is your site exposed to CVE-2018-11922?

Run a free security scan — no signup, results in seconds.

CVSS v3.1 Score

9.8

CRITICAL

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Weakness Type (CWE)

CWE-16 CWE-16

Affected Products

Vendor	Product	Versions
qualcomm	mdm9206_firmware	All
qualcomm	mdm9206	All
qualcomm	mdm9607_firmware	All
qualcomm	mdm9607	All
qualcomm	mdm9640_firmware	All
qualcomm	mdm9640	All
qualcomm	mdm9650_firmware	All
qualcomm	mdm9650	All
qualcomm	215_firmware	All
qualcomm	215	All
qualcomm	sd_210_firmware	All
qualcomm	sd_210	All
qualcomm	sd_212_firmware	All
qualcomm	sd_212	All
qualcomm	sd_205_firmware	All
qualcomm	sd_205	All
qualcomm	sd_425_firmware	All
qualcomm	sd_425	All
qualcomm	sd_427_firmware	All
qualcomm	sd_427	All
qualcomm	sd_430_firmware	All
qualcomm	sd_430	All
qualcomm	sd_435_firmware	All
qualcomm	sd_435	All
qualcomm	sd_439_firmware	All
qualcomm	sd_439	All
qualcomm	sd_429_firmware	All
qualcomm	sd_429	All
qualcomm	sd_450_firmware	All
qualcomm	sd_450	All
qualcomm	sd_625_firmware	All
qualcomm	sd_625	All
qualcomm	sd_632_firmware	All
qualcomm	sd_632	All
qualcomm	sd_845_firmware	All
qualcomm	sd_845	All
qualcomm	sd_850_firmware	All
qualcomm	sd_850	All
qualcomm	sda660_firmware	All
qualcomm	sda660	All
qualcomm	sdm439_firmware	All
qualcomm	sdm439	All
qualcomm	sdx20_firmware	All
qualcomm	sdx20	All

References

Advisories & Patches

https://docs.qualcomm.com/product/publicresources/securitybulletin/may-2018-bulletin.html

Frequently Asked Questions

What is CVE-2018-11922? +

Wrong configuration in Touch Pal application can collect user behavior data without awareness by the user. It has a CVSS v3.1 base score of 9.8 (CRITICAL).

How severe is CVE-2018-11922? +

CVE-2018-11922 has a CVSS v3.1 score of 9.8 out of 10, rated CRITICAL. This is a critical vulnerability that should be patched immediately.

What products are affected by CVE-2018-11922? +

CVE-2018-11922 affects products from qualcomm, specifically: 215, 215_firmware, mdm9206, mdm9206_firmware, mdm9607, mdm9607_firmware, mdm9640, mdm9640_firmware, mdm9650, mdm9650_firmware, sd_205, sd_205_firmware, sd_210, sd_210_firmware, sd_212, sd_212_firmware, sd_425, sd_425_firmware, sd_427, sd_427_firmware, sd_429, sd_429_firmware, sd_430, sd_430_firmware, sd_435, sd_435_firmware, sd_439, sd_439_firmware, sd_450, sd_450_firmware, sd_625, sd_625_firmware, sd_632, sd_632_firmware, sd_845, sd_845_firmware, sd_850, sd_850_firmware, sda660, sda660_firmware, sdm439, sdm439_firmware, sdx20, sdx20_firmware. Check the affected products table above for specific version ranges.

How do I check if I'm vulnerable to CVE-2018-11922? +

You can use Secably's free Website Scanner to check your website for known vulnerabilities. For infrastructure scanning, use the Port Scanner to identify exposed services that may be affected. Check the vendor advisories linked above for specific patch and version information.

Related Vulnerabilities

CVE-2024-46909 9.8

In WhatsUp Gold versions released before 2024.0.1, a remote unauthenticated attacker could leverage this vulnerability to execute code in the …

CVE-2025-12221 8.8

Busybox 1.31.1 - Multiple Known Vulnerabilities.This issue affects BLU-IC2: through 1.19.5; BLU-IC4: through 1.19.5.

CVE-2024-32991 7.5

Permission verification vulnerability in the wpa_supplicant module Impact: Successful exploitation of this vulnerability will affect availability.

CVE-2024-42031 7.5

Access permission verification vulnerability in the Settings module. Impact: Successful exploitation of this vulnerability may affect service confidentiality.

CVE-2023-33105 7.5

Transient DOS in WLAN Host and Firmware when large number of open authentication frames are sent with an invalid transaction …

CVE-2023-52719 7.1

Privilege escalation vulnerability in the PMS module Impact: Successful exploitation of this vulnerability may affect service confidentiality.