CVE-2026-24078: NG-eCall IPSec Information Disclosure Flaw

CVE-2026-24078 Overview

CVE-2026-24078 is an information disclosure vulnerability affecting Qualcomm components that handle Next Generation emergency Call (NG-eCall) Session Initiation Protocol (SIP) signaling. The flaw occurs when IP Security (IPSec) negotiation fails or is not established properly during signaling exchanges. When protected transport does not initialize as expected, sensitive session data can traverse the network without confidentiality controls. The issue is tracked under [CWE-359: Exposure of Private Personal Information to an Unauthorized Actor]. Qualcomm disclosed the vulnerability in its August 2026 Security Bulletin.

Critical Impact
An attacker with adjacent network access can observe SIP signaling content that should have been protected by IPSec, exposing confidential call setup information.

Affected Products

Qualcomm cellular modem and platform components implementing NG-eCall SIP signaling
Devices exposing IPSec-protected SIP over IMS interfaces
See the Qualcomm Security Bulletin August 2026 for the authoritative component list

Discovery Timeline

2026-08-04 - CVE-2026-24078 published to NVD
2026-08-06 - Last updated in NVD database

Technical Details for CVE-2026-24078

Vulnerability Analysis

NG-eCall relies on SIP signaling to establish emergency voice sessions between the in-vehicle system and the Public Safety Answering Point (PSAP). The specification requires IPSec to protect this signaling channel. CVE-2026-24078 arises when the IPSec Security Association fails to negotiate or is not established before SIP messages are transmitted. Under this condition, signaling proceeds over an unprotected path, exposing information that should have remained confidential. The vulnerability is classified as an information disclosure issue and does not affect integrity or availability.

Root Cause

The root cause is inadequate enforcement of transport-layer confidentiality preconditions. The implementation continues SIP message exchange when IPSec negotiation has not successfully completed, rather than failing closed. This falls under [CWE-359], where personal or session information is exposed to observers who should not have access to it.

Attack Vector

The attack vector is Adjacent Network, meaning the attacker must be positioned on the same logical network segment as the vulnerable device to observe traffic. User interaction is not required and no privileges are needed. Successful exploitation yields confidentiality impact only; the attacker passively captures SIP signaling exchanged during NG-eCall setup when the IPSec channel is missing or broken. No public exploit is available and the vulnerability is not listed in the CISA Known Exploited Vulnerabilities catalog.

No verified public proof-of-concept code is available for this vulnerability. Technical specifics are limited to the vendor advisory referenced above.

Detection Methods for CVE-2026-24078

Indicators of Compromise

SIP signaling packets observed on IMS-associated interfaces without an accompanying IPSec Encapsulating Security Payload header
IKE or IPSec negotiation failures logged in modem or IMS stack diagnostics immediately preceding NG-eCall session setup
Emergency call sessions completing without the expected Security Association lifetime entries

Detection Strategies

Inspect packet captures from IMS bearer interfaces for cleartext SIP INVITE, REGISTER, and related messages associated with eCall service identifiers.
Correlate modem-layer telemetry indicating IPSec setup failure with subsequent SIP transactions on the same bearer.
Alert on any NG-eCall SIP dialog established without a preceding successful IKE_AUTH or IPSec SA establishment event.

Monitoring Recommendations

Enable verbose logging for IMS security context establishment on managed telematics and mobile devices.
Monitor Qualcomm modem crash and diagnostic reports for repeated IPSec negotiation failures tied to emergency service APNs.
Review carrier-side signaling logs for cleartext SIP originating from subscribers on affected chipsets.

How to Mitigate CVE-2026-24078

Immediate Actions Required

Inventory devices using Qualcomm chipsets that implement NG-eCall and cross-reference against the August 2026 bulletin.
Apply the vendor patch through the device OEM or carrier update channel as soon as it is available.
Where patches are pending, restrict operation on untrusted adjacent networks that could permit passive interception of IMS traffic.

Patch Information

Qualcomm has published fixes in the Qualcomm Security Bulletin August 2026. OEMs must integrate the vendor updates into device firmware releases. End users receive the fix through their device manufacturer's or mobile carrier's over-the-air update process.

Workarounds

Enforce fail-closed behavior at the IMS stack where configurable, so SIP transactions are aborted if IPSec is not active.
Deploy affected devices only on trusted operator networks until the patched firmware is applied.
Where feasible, disable NG-eCall functionality on devices that do not require emergency call service until the patch is installed.

bash

# No official configuration workaround is published; see the vendor advisory
# https://docs.qualcomm.com/product/publicresources/securitybulletin/august-2026-bulletin.html