{"id":"CVE-2019-2278","aliases":["EUVD-2019-11920","GHSA-mhq7-486h-2f4f"],"status":"published","title":"User keystore signature is ignored in boot and can lead to bypass boot image signature...","description":"User keystore signature is ignored in boot and can lead to bypass boot image signature verification in Snapdragon Auto, Snapdragon Consumer IOT, Snapdragon Mobile in MDM9607, MDM9640, SD 425, SD 427, SD 430, SD 435, SD 450, SD 625, SD 636, SD 712 / SD 710 / SD 670, SD 845 / SD 850, SDM660","severity":{"version":"3.0","score":7.8,"vector":"CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","level":"high","assessor":"primary","from":"nvd"},"epss":{"day":"2026-11-09","score":0.00195,"percentile":0.09232,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":false},"cwes":["CWE-347"],"published":"2019-07-25T16:33:18Z","modified":"2026-06-17T02:33:35Z","products":[{"vendor":"qualcomm","product":"mdm9607_firmware"},{"vendor":"qualcomm","product":"mdm9640_firmware"},{"vendor":"qualcomm","product":"sd_425_firmware"},{"vendor":"qualcomm","product":"sd_427_firmware"},{"vendor":"qualcomm","product":"sd_430_firmware"},{"vendor":"qualcomm","product":"sd_435_firmware"},{"vendor":"qualcomm","product":"sd_450_firmware"},{"vendor":"qualcomm","product":"sd_625_firmware"},{"vendor":"qualcomm","product":"sd_636_firmware"},{"vendor":"qualcomm","product":"sd_670_firmware"},{"vendor":"qualcomm","product":"sd_710_firmware"},{"vendor":"qualcomm","product":"sd_712_firmware"},{"vendor":"qualcomm","product":"sd_845_firmware"},{"vendor":"qualcomm","product":"sd_850_firmware"},{"vendor":"qualcomm","product":"sdm660_firmware"},{"vendor":"qualcomm, inc.","product":"snapdragon auto, snapdragon consumer iot, snapdragon mobile"}],"references":[{"url":"https://www.codeaurora.org/security-bulletin/2019/07/01/july-2019-code-aurora-security-bulletin","tags":["x_refsource_CONFIRM","x_transferred","Patch","Third Party Advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2019-2278"},{"url":"https://github.com/advisories/GHSA-mhq7-486h-2f4f"}],"sources":{"cve":[{"id":"CVE-2019-2278","description":"User keystore signature is ignored in boot and can lead to bypass boot image signature verification in Snapdragon Auto, Snapdragon Consumer IOT, Snapdragon Mobile in MDM9607, MDM9640, SD 425, SD 427, SD 430, SD 435, SD 450, SD 625, SD 636, SD 712 / SD 710 / SD 670, SD 845 / SD 850, SDM660","status":"published","published":"2019-07-25T16:33:18Z","modified":"2024-08-04T18:42:51.125Z","updated_at":"2026-11-02T14:20:22.701371Z"}],"euvd":[{"id":"EUVD-2019-11920","description":"User keystore signature is ignored in boot and can lead to bypass boot image signature verification in Snapdragon Auto, Snapdragon Consumer IOT, Snapdragon Mobile in MDM9607, MDM9640, SD 425, SD 427, SD 430, SD 435, SD 450, SD 625, SD 636, SD 712 / SD 710 / SD 670, SD 845 / SD 850, SDM660","status":"published","published":"2019-07-25T16:33:18Z","modified":"2024-08-04T18:42:51Z","updated_at":"2026-11-03T03:06:56.04689Z"}],"ghsa":[{"id":"GHSA-mhq7-486h-2f4f","title":"User keystore signature is ignored in boot and can lead to bypass boot image signature...","description":"User keystore signature is ignored in boot and can lead to bypass boot image signature verification in Snapdragon Auto, Snapdragon Consumer IOT, Snapdragon Mobile in MDM9607, MDM9640, SD 425, SD 427, SD 430, SD 435, SD 450, SD 625, SD 636, SD 712 / SD 710 / SD 670, SD 845 / SD 850, SDM660","status":"published","published":"2022-05-24T16:51:24Z","modified":"2023-01-28T05:06:15Z","updated_at":"2026-11-02T14:44:24.844334Z"}],"nvd":[{"id":"CVE-2019-2278","description":"User keystore signature is ignored in boot and can lead to bypass boot image signature verification in Snapdragon Auto, Snapdragon Consumer IOT, Snapdragon Mobile in MDM9607, MDM9640, SD 425, SD 427, SD 430, SD 435, SD 450, SD 625, SD 636, SD 712 / SD 710 / SD 670, SD 845 / SD 850, SDM660","status":"published","published":"2019-07-25T17:15:12.817Z","modified":"2026-06-17T02:33:35.13Z","cvss":[{"version":"3.0","score":7.8,"vector":"CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","level":"high","assessor":"primary"},{"version":"2.0","score":7.2,"vector":"AV:L/AC:L/Au:N/C:C/I:C/A:C","level":"high","assessor":"primary"}],"cwes":["CWE-347"],"updated_at":"2026-11-02T14:05:21.892729Z"}]}}