CVE-2024-38426: Qualcomm 315 5G IoT Authentication Flaw

CVE-2024-38426 Overview

CVE-2024-38426 is an improper authentication vulnerability affecting a broad set of Qualcomm chipsets, including Snapdragon mobile, automotive, IoT, wearable, and modem-RF platforms. The flaw occurs while a User Equipment (UE) processes an authentication message, allowing an attacker in the radio path to trigger information disclosure. The weakness is classified under [CWE-287: Improper Authentication] and requires no privileges or user interaction to exploit over the network attack surface.

Qualcomm published the fix in the Qualcomm March 2025 Security Bulletin. The vulnerability was added to the NVD on March 3, 2025.

Critical Impact
A remote, unauthenticated attacker capable of interacting with the UE's cellular authentication exchange can extract confidential information from the modem stack without user interaction.

Affected Products

Qualcomm Snapdragon mobile SoCs including Snapdragon 8 Gen 1, Snapdragon 8 Gen 3, Snapdragon 865 5G, Snapdragon 870 5G, and Snapdragon 4/6/7-series
Qualcomm modem and modem-RF products including SDX55, SDX57M, SDX61, SDX71M, SDX80M, Snapdragon X55/X62/X65/X70/X72/X75 5G-RF, and MDM9205s/MDM9628/MDM9640
Qualcomm IoT, automotive, wearable, and connectivity platforms including 315 5G IoT, 9205 LTE, Snapdragon Auto 4G/5G-RF, Snapdragon Wear 1300/4100+, SW5100/SW5100P, and FastConnect 6200–7800 series

Discovery Timeline

2025-03-03 - Qualcomm publishes the March 2025 Security Bulletin containing the fix
2025-03-03 - CVE-2024-38426 published to NVD
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2024-38426

Vulnerability Analysis

The vulnerability resides in the User Equipment (UE) authentication message handling implemented in the Qualcomm cellular modem stack. During normal cellular attach and authentication procedures, the UE exchanges authentication messages with the network to establish mutual trust and derive session keys. The affected code path fails to properly enforce authentication checks on inbound messages, enabling an attacker positioned in the radio path to elicit confidential response data from the UE.

Exploitation occurs over the network (radio) attack vector and requires no prior authentication or user interaction. The impact is limited to confidentiality — an attacker cannot modify data or degrade device availability through this specific weakness, but disclosed information may include material useful for tracking, correlation, or downstream cellular attacks.

Root Cause

The root cause is improper authentication ([CWE-287]) inside the routine that processes authentication messages destined for the UE. The modem firmware does not adequately validate that a peer message satisfies the expected authentication conditions before returning sensitive protocol data. Because the flaw exists in low-level modem firmware shipped across hundreds of Qualcomm SKUs, the same defect propagates to a wide range of downstream OEM devices consuming those firmware images.

Attack Vector

An attacker within radio range of the target UE — for example, using a rogue base station or IMSI-catcher-style setup on cellular bands supported by the target — can transmit crafted authentication messages to the device. Because the affected code path executes before proper authentication is confirmed, the malformed or unauthenticated exchange can coerce the UE into leaking data from the modem's authentication state. No user interaction or on-device foothold is required.

No public proof-of-concept exploit has been published, and this CVE is not listed in the CISA Known Exploited Vulnerabilities catalog.

// No verified public exploit code is available for CVE-2024-38426.
// Refer to the Qualcomm March 2025 Security Bulletin for technical details.

Detection Methods for CVE-2024-38426

Indicators of Compromise

Unexpected reattach, re-authentication, or IMSI/SUCI request bursts logged in modem diagnostic traces
Presence of rogue or unauthorized base stations advertising the operator's PLMN in areas where devices are deployed
Anomalous downgrade attempts (5G-to-4G or 4G-to-2G) preceding suspicious authentication exchanges

Detection Strategies

Inventory endpoints and IoT/OT devices that ship Qualcomm modems listed in the Qualcomm March 2025 Security Bulletin and cross-check firmware build strings against the vendor-supplied fixed versions
Correlate mobile device management (MDM) attestation data and OEM security patch level (SPL) against the March 2025 Qualcomm patch baseline
For fleets in fixed locations (industrial IoT, automotive telematics), monitor cell tower identity, TAC, and signal characteristics to identify rogue base station activity

Monitoring Recommendations

Ingest MDM and endpoint telemetry into a centralized data platform to track patch level drift across Qualcomm-based devices
Track modem firmware and baseband versions as inventory attributes so newly disclosed Qualcomm CVEs can be scoped rapidly
Alert on cellular anomalies such as forced re-authentication storms or unexplained radio bearer resets that could indicate radio-layer probing

How to Mitigate CVE-2024-38426

Immediate Actions Required

Apply the Qualcomm security patches referenced in the March 2025 bulletin as soon as OEM device updates become available
Prioritize patching for high-value or high-exposure endpoints such as executive mobile devices, automotive telematics units, and cellular-connected IoT gateways
Coordinate with device OEMs and mobile carriers to confirm the March 2025 Qualcomm patch level is included in shipped over-the-air (OTA) updates

Patch Information

Qualcomm addressed CVE-2024-38426 in the Qualcomm March 2025 Security Bulletin. Fixes are delivered to end users through OEM firmware releases that incorporate the updated Qualcomm modem components. Verify the Android security patch level (SPL) or OEM firmware version reflects the March 2025 Qualcomm baseline or later.

Workarounds

No vendor-provided workaround exists; patching through the OEM update channel is the only supported remediation
Where feasible, restrict deployment of unpatched devices to trusted RF environments and away from untrusted cellular coverage
For fleet IoT deployments, consider using private cellular networks with strict base station authentication until patches are applied

bash

# Example: check Android security patch level on a managed device via adb
adb shell getprop ro.build.version.security_patch
# Confirm value is 2025-03-01 or later before considering the device remediated