CVE-2025-21430: Qualcomm 315 5G IoT Modem DOS Vulnerability

CVE-2025-21430 Overview

CVE-2025-21430 is a transient denial-of-service (DoS) vulnerability affecting a broad range of Qualcomm chipsets and firmware. The flaw is triggered during the Wi-Fi association process when a station (STA) connects to an access point (AP) and the AP initiates an ADD TS (Add Traffic Stream) request to establish a Traffic Specification (TSpec) session. Improper handling of the request leads to a buffer over-read condition [CWE-126], disrupting the affected component's availability. The vulnerability impacts hundreds of Qualcomm products, including Snapdragon mobile platforms, FastConnect Wi-Fi subsystems, automotive platforms, IoT modems, and modem-RF systems.

Critical Impact
A network-adjacent attacker operating a malicious access point can trigger a transient denial-of-service against any vulnerable Qualcomm-powered device that associates with it, affecting Wi-Fi connectivity across mobile, automotive, IoT, and wearable platforms.

Affected Products

Qualcomm Snapdragon mobile platforms (Snapdragon 8 Gen 1/2/3, 8+ Gen 1/2, 855, 865, 870, and earlier generations)
Qualcomm FastConnect Wi-Fi subsystems (FastConnect 6200, 6700, 6800, 6900, 7800)
Qualcomm automotive, IoT, modem-RF, and wearable platforms (SA8xxx series, QCS series, QCA series, Snapdragon Auto 4G/5G Modem-RF, Snapdragon W5+ Gen 1)

Discovery Timeline

2025-04-07 - CVE-2025-21430 published to NVD
April 2025 - Qualcomm releases security patch via April 2025 Security Bulletin
2025-10-06 - Last updated in NVD database

Technical Details for CVE-2025-21430

Vulnerability Analysis

The vulnerability resides in the Wi-Fi subsystem firmware of affected Qualcomm chipsets. It is exposed during the IEEE 802.11 association sequence when an access point sends an ADD TS request to negotiate Quality of Service (QoS) parameters for a Traffic Specification (TSpec) session. The TSpec mechanism is defined in the 802.11e amendment and allows the AP to allocate dedicated airtime and bandwidth for traffic streams.

When the affected firmware processes a malformed or unexpected ADD TS request, it reads beyond the intended buffer boundary. This triggers a transient DoS condition that disrupts Wi-Fi operation on the affected device. The condition is classified as a buffer over-read [CWE-126], where the firmware accesses memory outside the bounds of the expected data structure.

The attack requires no authentication, no user interaction, and low complexity. Confidentiality and integrity remain intact, but availability of the Wi-Fi component is fully impacted.

Root Cause

The root cause is improper validation of length or boundary fields within ADD TS request frames during TSpec session establishment. The firmware parser fails to verify that the supplied data conforms to expected size constraints before reading from the buffer, resulting in an out-of-bounds read.

Attack Vector

An attacker operates a rogue or controlled access point and waits for a vulnerable Qualcomm-based station to initiate association. During association, the attacker-controlled AP sends a crafted ADD TS request to the connecting STA. Processing of the malformed request triggers the buffer over-read in the Wi-Fi firmware, causing a transient denial-of-service on the device's Wi-Fi stack.

No verified public proof-of-concept code is available. The vulnerability mechanism is described in the Qualcomm April 2025 Security Bulletin.

Detection Methods for CVE-2025-21430

Indicators of Compromise

Unexpected Wi-Fi disconnections or radio resets on Qualcomm-powered devices shortly after associating with an unfamiliar access point
Firmware crash logs or kernel messages referencing the WLAN driver, TSpec, or ADD TS handling on affected Snapdragon, FastConnect, or QCA components
Repeated 802.11 association attempts followed by immediate connectivity loss in environments where untrusted APs are present

Detection Strategies

Monitor wireless intrusion detection systems (WIDS) for rogue access points broadcasting in proximity to managed devices
Inspect 802.11 management and action frame captures for malformed ADD TS request elements during TSpec negotiation
Correlate endpoint Wi-Fi driver crash telemetry with proximity to unknown SSIDs or BSSIDs to identify potential exploitation attempts

Monitoring Recommendations

Centralize and review firmware and kernel logs from mobile, automotive, and IoT fleet devices for repeated WLAN subsystem failures
Track patch compliance against the Qualcomm April 2025 Security Bulletin across all device classes that ship affected chipsets
Deploy WIDS/WIPS coverage in sensitive locations to detect and contain hostile access points used to deliver malformed 802.11 frames

How to Mitigate CVE-2025-21430

Immediate Actions Required

Apply the firmware update released in the Qualcomm April 2025 Security Bulletin to all affected chipsets through OEM and carrier update channels
Inventory deployed devices against the affected product list, prioritizing always-on automotive, IoT, and infrastructure systems that rely on Wi-Fi availability
Restrict managed devices to known trusted SSIDs in sensitive environments until patches are confirmed installed

Patch Information

Qualcomm has published fixes through its April 2025 Security Bulletin. Patches are distributed downstream by device OEMs, carriers, and platform integrators. Verify with the device vendor that the security patch level corresponds to the April 2025 Qualcomm release or later.

Workarounds

Disable Wi-Fi on affected devices in untrusted environments until firmware updates are applied
Configure enterprise mobility management (EMM/MDM) policies to restrict client devices to verified corporate SSIDs and prevent auto-association with open networks
Deploy wireless intrusion prevention to detect and contain rogue access points before vulnerable clients associate with them

bash

# Example: MDM policy snippet to restrict Wi-Fi to approved SSIDs
# (vendor-specific syntax; adapt to your EMM platform)
wifi.policy.allowed_ssids = ["CorpSecure", "CorpGuest"]
wifi.policy.auto_join_open_networks = false
wifi.policy.require_wpa2_enterprise = true