CVE-2024-45552: Qualcomm Firmware Info Disclosure Flaw

CVE-2024-45552 Overview

CVE-2024-45552 is an information disclosure vulnerability affecting a broad range of Qualcomm chipsets and firmware components. The flaw is triggered when a device processes a non-conforming Real-time Transport Control Protocol (RTCP) packet that does not adhere to RFC standards during a video call. Improper handling of the malformed packet causes the device to reset, and sensitive data may be exposed as a result.

The vulnerability is classified under [CWE-126] (Buffer Over-read) and impacts Snapdragon mobile, automotive, FastConnect, and a wide range of WCN, WCD, and WSA firmware components. Exploitation requires no authentication or user interaction and is reachable over the network.

Critical Impact
A remote attacker can trigger a device reset and induce information disclosure on affected Qualcomm chipsets simply by sending a crafted RTCP packet during an active video call session.

Affected Products

Qualcomm Snapdragon mobile platforms including Snapdragon 8 Gen 2, 8 Gen 3, 8+ Gen 1, 8+ Gen 2, 865/865+/870 5G, and 4 Gen 1
Qualcomm FastConnect 6200, 6700, 6800, 6900, and 7800 connectivity firmware
Qualcomm automotive, XR, wearable, and IoT platforms (SA8255P, SA8775P, Snapdragon XR2 5G, Snapdragon W5+ Gen 1, Robotics RB3, Vision Intelligence 400)

Discovery Timeline

2025-04-07 - CVE-2024-45552 published to NVD
2025-10-06 - Last updated in NVD database

Technical Details for CVE-2024-45552

Vulnerability Analysis

The vulnerability resides in the RTCP packet processing logic within Qualcomm firmware that handles video call signaling. RTCP is the control companion protocol to RTP and carries quality-of-service feedback, sender reports, and receiver reports between endpoints during real-time media sessions.

When the firmware receives an RTCP packet that violates the structural requirements defined in RFC 3550, parsing logic reads beyond the intended bounds of the packet buffer. This buffer over-read, mapped to [CWE-126], destabilizes the firmware and forces a device reset. During the reset and recovery cycle, fragments of adjacent memory contents may be exposed, leading to disclosure of sensitive data residing in the firmware's address space.

Because the affected components include modem, audio codec, and connectivity firmware, the impact spans mobile handsets, automotive head units, XR headsets, and IoT devices that perform video call functionality.

Root Cause

The root cause is insufficient input validation on RTCP packet fields. The firmware's parser does not adequately verify length fields, padding indicators, or block counts against the actual packet size before dereferencing memory offsets. A non-conforming packet causes the parser to read past the packet boundary, triggering an exception that resets the device.

Attack Vector

The attack vector is network-based and requires no authentication. An attacker who can deliver RTCP traffic to a target device during an active video call — for example, as a participant in a VoIP or IMS video session — can send a crafted RTCP packet that violates RFC formatting. The malformed packet is processed by the vulnerable firmware component, triggering the reset and information disclosure condition. No user interaction beyond being on the video call is required.

The vulnerability is described in prose because no public proof-of-concept code or verified exploit examples have been released. Refer to the Qualcomm April 2025 Security Bulletin for vendor-supplied technical details.

Detection Methods for CVE-2024-45552

Indicators of Compromise

Unexpected modem, audio, or connectivity subsystem resets during or immediately following video calls
Crash logs or kernel messages referencing RTCP parsing routines in Qualcomm firmware components
Repeated reconnection events on FastConnect or WCN subsystems correlated with inbound video call traffic

Detection Strategies

Monitor mobile device management (MDM) telemetry for abnormal device or subsystem reboot patterns on Snapdragon-based fleets
Inspect RTCP traffic on enterprise VoIP gateways for malformed packets that violate RFC 3550 length, padding, or block count fields
Correlate firmware crash dumps with video call session timestamps to identify exploitation attempts

Monitoring Recommendations

Enable verbose logging on VoIP and IMS infrastructure to capture RTCP packet anomalies and source addresses
Track Qualcomm security bulletin versions deployed across managed devices to identify unpatched assets
Establish baseline reset rates for connectivity and modem firmware so deviations can be flagged for investigation

How to Mitigate CVE-2024-45552

Immediate Actions Required

Inventory all devices using affected Qualcomm chipsets and firmware components listed in the April 2025 security bulletin
Apply OEM firmware updates incorporating Qualcomm's patch as soon as they are released by the device manufacturer
Restrict exposure of vulnerable devices to untrusted video call peers and prefer enterprise-controlled VoIP infrastructure

Patch Information

Qualcomm released patches for this issue in its Qualcomm April 2025 Security Bulletin. Patches are distributed to original equipment manufacturers (OEMs), who must integrate them into device-specific firmware updates. Administrators should verify that OEM updates incorporating the April 2025 Qualcomm patch level are installed on all affected devices.

Workarounds

Limit video calling to trusted networks and authenticated peers until patched firmware is deployed
Deploy RTCP packet validation at session border controllers or VoIP gateways to drop malformed packets before they reach endpoints
Disable video call functionality on high-risk or unpatched devices where the feature is non-essential

bash

# Example: session border controller rule to drop malformed RTCP packets
# (vendor syntax varies - consult your SBC documentation)
rtcp-validation strict
rtcp-rfc-compliance enforce
rtcp-drop-malformed enable