CVE-2025-21435: Qualcomm AR8035 Firmware DOS Vulnerability

CVE-2025-21435 Overview

CVE-2025-21435 is a buffer over-read vulnerability (CWE-126) affecting Qualcomm firmware components used in Wi-Fi chipsets and wireless connectivity modules. The vulnerability occurs during the parsing of extended Information Elements (IE) within beacon frames, potentially allowing a remote attacker to trigger a transient denial of service condition on affected devices.

This vulnerability impacts a wide range of Qualcomm products including networking chipsets, mobile platform firmware, automotive platforms, and IoT/home networking solutions. The attack can be executed remotely over a network without requiring user interaction or prior authentication, making it particularly concerning for wireless infrastructure deployments.

Critical Impact

Remote attackers can cause denial of service on affected Qualcomm wireless devices by sending specially crafted beacon frames with malformed extended Information Elements.

Affected Products

• Qualcomm FastConnect 6800/6900/7800 Wi-Fi Chipsets
• Qualcomm Snapdragon 8 Gen 3, 865/865+/870 5G Mobile Platforms
• Qualcomm IPQ Series Networking Processors (IPQ5xxx, IPQ6xxx, IPQ8xxx, IPQ9xxx)
• Qualcomm QCA/QCN Series Wi-Fi Chipsets
• Qualcomm Immersive Home Platform Series
• Qualcomm SA6155P/SA8155P/SA8195P Automotive Platforms
• Qualcomm WCN Series Wireless Connectivity Modules

Discovery Timeline

• April 7, 2025 - CVE-2025-21435 published to NVD
• October 6, 2025 - Last updated in NVD database

Technical Details for CVE-2025-21435

Vulnerability Analysis

The vulnerability exists in the beacon frame parsing functionality within affected Qualcomm firmware. When processing Wi-Fi management frames, specifically beacon frames containing extended Information Elements, the firmware fails to properly validate the length of IE data before reading from the buffer. This allows an attacker to craft beacon frames with malformed extended IE fields that cause the parser to read beyond the allocated buffer boundaries.

The buffer over-read condition (CWE-126) occurs when the firmware attempts to parse extended IE fields without adequate bounds checking. Extended Information Elements in 802.11 beacon frames can contain various types of data including vendor-specific extensions, Wi-Fi 6 capabilities, and other protocol parameters. The parsing routine trusts the length values specified in the IE header without validating that sufficient data actually exists in the frame.

Root Cause

The root cause is improper input validation in the extended IE parsing code. The firmware reads length values from untrusted input (the beacon frame) and uses these values to control buffer read operations without first verifying that the specified length does not exceed the actual available data. This is a classic buffer over-read scenario where the code fails to enforce boundary conditions on externally-supplied length parameters.

Attack Vector

The attack requires network proximity to the target device, typically within Wi-Fi range. An attacker can craft malicious beacon frames containing extended Information Elements with invalid length fields. When a vulnerable Qualcomm wireless device processes these beacon frames during passive or active scanning operations, the buffer over-read is triggered.

The attack does not require authentication or user interaction, as beacon frames are processed automatically by Wi-Fi devices during normal operation. The transient denial of service occurs when the over-read triggers a fault condition in the wireless subsystem firmware, causing temporary service disruption. Recovery may require device restart or Wi-Fi subsystem reset depending on the specific hardware and software implementation.

An attacker would construct beacon frames with extended IE structures where the declared length exceeds the actual payload. When the parsing function attempts to read the full declared length, it reads beyond valid memory, potentially causing undefined behavior or a crash in the wireless firmware component.

Detection Methods for CVE-2025-21435

Indicators of Compromise

• Unexpected Wi-Fi disconnections or service interruptions on devices with Qualcomm wireless chipsets
• Repeated wireless subsystem crashes or watchdog resets in device logs
• Anomalous beacon frames with unusually large extended IE length values observed in wireless traffic captures
• Firmware crash reports indicating memory access violations in Wi-Fi driver components

Detection Strategies

• Monitor wireless network traffic for beacon frames containing extended Information Elements with suspicious length values that exceed standard frame boundaries
• Implement network intrusion detection rules to identify malformed 802.11 management frames targeting Wi-Fi infrastructure
• Enable enhanced logging on wireless access points and clients to capture parsing errors or memory access faults during beacon processing
• Deploy wireless intrusion prevention systems capable of filtering malicious beacon frames before they reach vulnerable endpoints

Monitoring Recommendations

• Enable firmware crash reporting and monitoring on devices containing affected Qualcomm wireless chipsets
• Implement centralized logging for wireless subsystem events across enterprise deployments
• Monitor for patterns of service disruptions that correlate with specific wireless environments or rogue access point activity
• Conduct periodic wireless security assessments to identify potential attack vectors in the RF environment

How to Mitigate CVE-2025-21435

Immediate Actions Required

• Inventory all devices containing affected Qualcomm wireless chipsets in your environment
• Review the Qualcomm April 2025 Security Bulletin for specific patch availability for your products
• Prioritize firmware updates for devices in high-risk environments such as public Wi-Fi deployments
• Implement network segmentation to limit potential attack surface for wireless denial of service attacks

Patch Information

Qualcomm has released security patches addressing this vulnerability as part of their April 2025 Security Bulletin. Device manufacturers (OEMs) are responsible for integrating these patches into their firmware releases. Organizations should contact their device vendors for specific patch availability timelines and update procedures.

The security bulletin is available at the Qualcomm Security Bulletin Portal. Due to the wide range of affected products including mobile devices, networking equipment, automotive platforms, and IoT devices, patch deployment timelines will vary by vendor and product category.

Workarounds

• Where possible, limit exposure to untrusted wireless networks until patches can be applied
• Consider implementing MAC address filtering and rogue AP detection to reduce attack surface from unknown wireless transmitters
• For critical infrastructure, evaluate the use of wired connectivity as an alternative to Wi-Fi where feasible
• Monitor vendor communications for emergency firmware updates and apply them according to organizational change management procedures

# Example: Check for Qualcomm wireless chipset presence on Linux systems
lspci | grep -i qualcomm
lsusb | grep -i qualcomm

# Review wireless subsystem logs for crash indicators
dmesg | grep -i "wlan\|ath\|qca\|wifi" | grep -i "error\|fault\|crash"