{"id":"CVE-2020-11209","aliases":["EUVD-2020-3563","GHSA-9q9w-f94c-rxwx"],"status":"published","title":"u'Improper authorization in DSP process could allow unauthorized users to downgrade the library...","description":"Improper authorization in DSP process could allow unauthorized users to downgrade the library versions in SD820, SD821, SD820, QCS603, QCS605, SDA855, SA6155P, SA6145P, SA6155, SA6155P, SD855, SD 675, SD660, SD429, SD439","severity":{"version":"3.1","score":5.5,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N","level":"medium","assessor":"primary","from":"nvd"},"epss":{"day":"2026-11-09","score":0.01568,"percentile":0.75517,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":false},"cwes":["CWE-125","CWE-863"],"published":"2020-11-12T10:00:58Z","modified":"2026-06-17T02:49:34Z","products":[{"vendor":"qualcomm","product":"qcs603_firmware"},{"vendor":"qualcomm","product":"qcs605_firmware"},{"vendor":"qualcomm","product":"sa6145p_firmware"},{"vendor":"qualcomm","product":"sa6155_firmware"},{"vendor":"qualcomm","product":"sa6155p_firmware"},{"vendor":"qualcomm","product":"sd429_firmware"},{"vendor":"qualcomm","product":"sd439_firmware"},{"vendor":"qualcomm","product":"sd660_firmware"},{"vendor":"qualcomm","product":"sd820_firmware"},{"vendor":"qualcomm","product":"sd821_firmware"},{"vendor":"qualcomm","product":"sd855_firmware"},{"vendor":"qualcomm","product":"sd_675_firmware"},{"vendor":"qualcomm","product":"sda855_firmware"},{"vendor":"qualcomm, inc.","product":"snapdragon auto, snapdragon consumer iot, snapdragon mobile"}],"references":[{"url":"https://www.qualcomm.com/company/product-security/bulletins/november-2020-bulletin","tags":["x_refsource_CONFIRM","x_transferred","Broken Link","Vendor Advisory"]},{"url":"https://blog.checkpoint.com/2020/08/06/achilles-small-chip-big-peril/","tags":["x_refsource_MISC","x_transferred","Third Party Advisory"]},{"url":"https://research.checkpoint.com/2021/pwn2own-qualcomm-dsp/","tags":["x_refsource_MISC","x_transferred","Exploit","Third Party Advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2020-11209"},{"url":"https://github.com/advisories/GHSA-9q9w-f94c-rxwx"}],"sources":{"cve":[{"id":"CVE-2020-11209","description":"Improper authorization in DSP process could allow unauthorized users to downgrade the library versions in SD820, SD821, SD820, QCS603, QCS605, SDA855, SA6155P, SA6145P, SA6155, SA6155P, SD855, SD 675, SD660, SD429, SD439","status":"published","published":"2020-11-12T10:00:58Z","modified":"2024-08-04T11:28:13.255Z","updated_at":"2026-11-02T14:35:57.352161Z"}],"euvd":[{"id":"EUVD-2020-3563","description":"Improper authorization in DSP process could allow unauthorized users to downgrade the library versions in SD820, SD821, SD820, QCS603, QCS605, SDA855, SA6155P, SA6145P, SA6155, SA6155P, SD855, SD 675, SD660, SD429, SD439","status":"published","published":"2020-11-12T10:00:58Z","modified":"2024-08-04T11:28:13Z","updated_at":"2026-11-03T03:07:47.032228Z"}],"ghsa":[{"id":"GHSA-9q9w-f94c-rxwx","title":"u'Improper authorization in DSP process could allow unauthorized users to downgrade the library...","description":"u'Improper authorization in DSP process could allow unauthorized users to downgrade the library versions in SD820, SD821, SD820, QCS603, QCS605, SDA855, SA6155P, SA6145P, SA6155, SA6155P, SD855, SD 675, SD660, SD429, SD439","status":"published","published":"2022-05-24T17:33:31Z","modified":"2023-01-29T05:05:15Z","cwes":["CWE-125","CWE-863"],"updated_at":"2026-11-02T14:45:44.97547Z"}],"nvd":[{"id":"CVE-2020-11209","description":"Improper authorization in DSP process could allow unauthorized users to downgrade the library versions in SD820, SD821, SD820, QCS603, QCS605, SDA855, SA6155P, SA6145P, SA6155, SA6155P, SD855, SD 675, SD660, SD429, SD439","status":"published","published":"2020-11-12T10:15:13.25Z","modified":"2026-06-17T02:49:34.203Z","cvss":[{"version":"3.1","score":5.5,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N","level":"medium","assessor":"primary"},{"version":"2.0","score":2.1,"vector":"AV:L/AC:L/Au:N/C:N/I:P/A:N","level":"low","assessor":"primary"}],"cwes":["CWE-863"],"updated_at":"2026-11-02T14:06:24.137599Z"}]}}