« Back to list

CVE-2014-9985

Status: ModifiedCritical (9.8)—

In Android before 2018-04-05 or earlier security patch level on Qualcomm Snapdragon Mobile MDM9635M, SD 400, and SD 800, TOCTOU condition may result in bypassing error condition checks, leading to undefined behavior.

CVSS

Exploitation probability (EPSS)

EPSS (Exploit Prediction Scoring System, FIRST) estimates how likely a vulnerability is to be exploited in the wild within 30 days. It complements CVSS (impact) and CISA KEV (confirmed exploitation).

Affected technologies (3)

Qualcomm — Mdm9635m FirmwareQualcomm — SD 400 FirmwareQualcomm — SD 800 Firmware

CWEs

References

Raw JSON (NVD)

Show
{
  "id": "CVE-2014-9985",
  "cveTags": [],
  "metrics": {
    "cvssMetricV2": [
      {
        "type": "Primary",
        "source": "nvd@nist.gov",
        "cvssData": {
          "version": "2.0",
          "baseScore": 10,
          "accessVector": "NETWORK",
          "vectorString": "AV:N/AC:L/Au:N/C:C/I:C/A:C",
          "authentication": "NONE",
          "integrityImpact": "COMPLETE",
          "accessComplexity": "LOW",
          "availabilityImpact": "COMPLETE",
          "confidentialityImpact": "COMPLETE"
        },
        "acInsufInfo": true,
        "impactScore": 10,
        "baseSeverity": "HIGH",
        "obtainAllPrivilege": false,
        "exploitabilityScore": 10,
        "obtainUserPrivilege": false,
        "obtainOtherPrivilege": false,
        "userInteractionRequired": false
      }
    ],
    "cvssMetricV30": [
      {
        "type": "Primary",
        "source": "nvd@nist.gov",
        "cvssData": {
          "scope": "UNCHANGED",
          "version": "3.0",
          "baseScore": 9.8,
          "attackVector": "NETWORK",
          "baseSeverity": "CRITICAL",
          "vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
          "integrityImpact": "HIGH",
          "userInteraction": "NONE",
          "attackComplexity": "LOW",
          "availabilityImpact": "HIGH",
          "privilegesRequired": "NONE",
          "confidentialityImpact": "HIGH"
        },
        "impactScore": 5.9,
        "exploitabilityScore": 3.9
      }
    ]
  },
  "affected": [
    {
      "source": "product-security@qualcomm.com",
      "affectedData": [
        {
          "vendor": "Qualcomm, Inc.",
          "product": "Snapdragon Mobile",
          "versions": [
            {
              "status": "affected",
              "version": "MDM9635M, SD 400, SD 800"
            }
          ]
        }
      ]
    }
  ],
  "published": "2018-04-18T14:29:01.323",
  "references": [
    {
      "url": "http://www.securityfocus.com/bid/103671",
      "tags": [
        "Third Party Advisory",
        "VDB Entry"
      ],
      "source": "product-security@qualcomm.com"
    },
    {
      "url": "https://source.android.com/security/bulletin/2018-04-01",
      "tags": [
        "Vendor Advisory"
      ],
      "source": "product-security@qualcomm.com"
    },
    {
      "url": "http://www.securityfocus.com/bid/103671",
      "tags": [
        "Third Party Advisory",
        "VDB Entry"
      ],
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "https://source.android.com/security/bulletin/2018-04-01",
      "tags": [
        "Vendor Advisory"
      ],
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    }
  ],
  "vulnStatus": "Modified",
  "weaknesses": [
    {
      "type": "Primary",
      "source": "nvd@nist.gov",
      "description": [
        {
          "lang": "en",
          "value": "CWE-388"
        }
      ]
    }
  ],
  "descriptions": [
    {
      "lang": "en",
      "value": "In Android before 2018-04-05 or earlier security patch level on Qualcomm Snapdragon Mobile MDM9635M, SD 400, and SD 800, TOCTOU condition may result in bypassing error condition checks, leading to undefined behavior."
    },
    {
      "lang": "es",
      "value": "En Android antes del nivel de parcheo de seguridad del 2018-04-05 o antes en Qualcomm Snapdragon Mobile MDM9635M, SD 400 y SD 800, una condición TOCTOU podría resultar en la omisión de comprobaciones de condición de error, lo que conduce a un comportamiento no definido."
    }
  ],
  "lastModified": "2026-06-17T00:19:21.390",
  "configurations": [
    {
      "nodes": [
        {
          "negate": false,
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:o:qualcomm:mdm9635m_firmware:-:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "9EF77DD1-BE11-4132-9889-646196FAE567"
            }
          ],
          "operator": "OR"
        },
        {
          "negate": false,
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:h:qualcomm:mdm9635m:-:*:*:*:*:*:*:*",
              "vulnerable": false,
              "matchCriteriaId": "CB323C15-2018-4CB8-858E-56F088B03FBB"
            }
          ],
          "operator": "OR"
        }
      ],
      "operator": "AND"
    },
    {
      "nodes": [
        {
          "negate": false,
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:o:qualcomm:sd_400_firmware:-:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "AC3C20F8-9EFD-457C-B0B2-DA3C44A8B26D"
            }
          ],
          "operator": "OR"
        },
        {
          "negate": false,
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:h:qualcomm:sd_400:-:*:*:*:*:*:*:*",
              "vulnerable": false,
              "matchCriteriaId": "4B562043-7A0C-4692-A94F-EF4086BAA654"
            }
          ],
          "operator": "OR"
        }
      ],
      "operator": "AND"
    },
    {
      "nodes": [
        {
          "negate": false,
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:o:qualcomm:sd_800_firmware:-:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "67E0DD11-0B28-4B6D-BDB7-0DBFA34A7187"
            }
          ],
          "operator": "OR"
        },
        {
          "negate": false,
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:h:qualcomm:sd_800:-:*:*:*:*:*:*:*",
              "vulnerable": false,
              "matchCriteriaId": "551512D0-ED24-4B5A-BEB2-B090BB8DEE0C"
            }
          ],
          "operator": "OR"
        }
      ],
      "operator": "AND"
    }
  ],
  "sourceIdentifier": "product-security@qualcomm.com"
}