{"id":"CVE-2019-14001","aliases":["EUVD-2019-5259","GHSA-xx27-vcf5-wm84"],"status":"published","title":"Wrong public key usage from existing oem_keystore for hash generation in Snapdragon Auto,...","description":"Wrong public key usage from existing oem_keystore for hash generation in Snapdragon Auto, Snapdragon Consumer IOT, Snapdragon Industrial IOT, Snapdragon Mobile, Snapdragon Voice \u0026 Music, Snapdragon Wearables in APQ8009, APQ8017, APQ8053, APQ8096AU, MDM9206, MDM9207C, MDM9607, MDM9650, MSM8905, MSM8909W, MSM8917, MSM8953, MSM8996AU, QM215, SDM429, SDM429W, SDM439, SDM450, SDM630, SDM632, SDM636, SDM660, SDX20","severity":{"version":"3.1","score":7.8,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","level":"high","assessor":"primary","from":"nvd"},"epss":{"day":"2026-11-10","score":0.00149,"percentile":0.04137,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":false},"cwes":["CWE-327"],"published":"2020-04-16T10:46:08Z","modified":"2026-06-17T02:17:36Z","products":[{"vendor":"qualcomm","product":"apq8009_firmware"},{"vendor":"qualcomm","product":"apq8017_firmware"},{"vendor":"qualcomm","product":"apq8053_firmware"},{"vendor":"qualcomm","product":"apq8096au_firmware"},{"vendor":"qualcomm","product":"mdm9206_firmware"},{"vendor":"qualcomm","product":"mdm9207c_firmware"},{"vendor":"qualcomm","product":"mdm9607_firmware"},{"vendor":"qualcomm","product":"mdm9650_firmware"},{"vendor":"qualcomm","product":"msm8905_firmware"},{"vendor":"qualcomm","product":"msm8909w_firmware"},{"vendor":"qualcomm","product":"msm8917_firmware"},{"vendor":"qualcomm","product":"msm8953_firmware"},{"vendor":"qualcomm","product":"msm8996au_firmware"},{"vendor":"qualcomm","product":"qm215_firmware"},{"vendor":"qualcomm","product":"sdm429_firmware"},{"vendor":"qualcomm","product":"sdm429w_firmware"},{"vendor":"qualcomm","product":"sdm439_firmware"},{"vendor":"qualcomm","product":"sdm450_firmware"},{"vendor":"qualcomm","product":"sdm630_firmware"},{"vendor":"qualcomm","product":"sdm632_firmware"},{"vendor":"qualcomm","product":"sdm636_firmware"},{"vendor":"qualcomm","product":"sdm660_firmware"},{"vendor":"qualcomm","product":"sdx20_firmware"},{"vendor":"qualcomm, inc.","product":"snapdragon auto, snapdragon consumer iot, snapdragon industrial iot, snapdragon mobile, snapdragon voice \u0026 music, snapdragon wearables"}],"references":[{"url":"https://www.qualcomm.com/company/product-security/bulletins/april-2020-bulletin","tags":["x_refsource_CONFIRM","x_transferred","Patch","Vendor Advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2019-14001"},{"url":"https://github.com/advisories/GHSA-xx27-vcf5-wm84"}],"sources":{"cve":[{"id":"CVE-2019-14001","description":"Wrong public key usage from existing oem_keystore for hash generation in Snapdragon Auto, Snapdragon Consumer IOT, Snapdragon Industrial IOT, Snapdragon Mobile, Snapdragon Voice \u0026 Music, Snapdragon Wearables in APQ8009, APQ8017, APQ8053, APQ8096AU, MDM9206, MDM9207C, MDM9607, MDM9650, MSM8905, MSM8909W, MSM8917, MSM8953, MSM8996AU, QM215, SDM429, SDM429W, SDM439, SDM450, SDM630, SDM632, SDM636, SDM660, SDX20","status":"published","published":"2020-04-16T10:46:08Z","modified":"2024-08-05T00:05:44.187Z","updated_at":"2026-11-02T14:20:17.722148Z"}],"euvd":[{"id":"EUVD-2019-5259","description":"Wrong public key usage from existing oem_keystore for hash generation in Snapdragon Auto, Snapdragon Consumer IOT, Snapdragon Industrial IOT, Snapdragon Mobile, Snapdragon Voice \u0026 Music, Snapdragon Wearables in APQ8009, APQ8017, APQ8053, APQ8096AU, MDM9206, MDM9207C, MDM9607, MDM9650, MSM8905, MSM8909W, MSM8917, MSM8953, MSM8996AU, QM215, SDM429, SDM429W, SDM439, SDM450, SDM630, SDM632, SDM636, SDM660, SDX20","status":"published","published":"2020-04-16T10:46:08Z","modified":"2024-08-05T00:05:44Z","updated_at":"2026-11-03T02:40:41.120486Z"}],"ghsa":[{"id":"GHSA-xx27-vcf5-wm84","title":"Wrong public key usage from existing oem_keystore for hash generation in Snapdragon Auto,...","description":"Wrong public key usage from existing oem_keystore for hash generation in Snapdragon Auto, Snapdragon Consumer IOT, Snapdragon Industrial IOT, Snapdragon Mobile, Snapdragon Voice \u0026 Music, Snapdragon Wearables in APQ8009, APQ8017, APQ8053, APQ8096AU, MDM9206, MDM9207C, MDM9607, MDM9650, MSM8905, MSM8909W, MSM8917, MSM8953, MSM8996AU, QM215, SDM429, SDM429W, SDM439, SDM450, SDM630, SDM632, SDM636, SDM660, SDX20","status":"published","published":"2022-05-24T17:15:21Z","modified":"2023-01-29T05:02:12Z","updated_at":"2026-11-02T14:45:01.576953Z"}],"nvd":[{"id":"CVE-2019-14001","description":"Wrong public key usage from existing oem_keystore for hash generation in Snapdragon Auto, Snapdragon Consumer IOT, Snapdragon Industrial IOT, Snapdragon Mobile, Snapdragon Voice \u0026 Music, Snapdragon Wearables in APQ8009, APQ8017, APQ8053, APQ8096AU, MDM9206, MDM9207C, MDM9607, MDM9650, MSM8905, MSM8909W, MSM8917, MSM8953, MSM8996AU, QM215, SDM429, SDM429W, SDM439, SDM450, SDM630, SDM632, SDM636, SDM660, SDX20","status":"published","published":"2020-04-16T11:15:14.213Z","modified":"2026-06-17T02:17:36.173Z","cvss":[{"version":"3.1","score":7.8,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","level":"high","assessor":"primary"},{"version":"2.0","score":4.6,"vector":"AV:L/AC:L/Au:N/C:P/I:P/A:P","level":"medium","assessor":"primary"}],"cwes":["CWE-327"],"updated_at":"2026-11-02T14:05:46.451008Z"}]}}