CVE-2026-24084
Received Received - Intake

UE Security Capability Replay Weak Configuration Vulnerability

Publication date: 2026-08-04

Last updated on: 2026-08-04

Assigner: Qualcomm, Inc.

Description
Weak configuration when UE does not verify the consistency of its additional security capabilities with the replayed capabilities.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-08-04
Last Modified
2026-08-04
Generated
2026-08-04
AI Q&A
2026-08-04
EPSS Evaluated
N/A
NVD
CVE-2026-24084
EUVD
EUVD-2026-52735

Affected Vendors & Products

Currently, no data is known.

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-1294 The System-on-Chip (SoC) implements a Security Identifier mechanism to differentiate what actions are allowed or disallowed when a transaction originates from an entity. However, the Security Identifiers are not correctly implemented.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability involves a weak configuration where a user equipment (UE) fails to verify the consistency of its additional security capabilities with the replayed capabilities. This could allow an attacker to exploit the inconsistency to bypass security measures.

Impact Analysis

An attacker could exploit this to gain unauthorized access or intercept sensitive information by manipulating security capabilities. The high CVSS score (7.5) indicates significant potential impact on confidentiality.

Compliance Impact

This vulnerability could lead to unauthorized data access or breaches, violating GDPR (data protection) and HIPAA (health information privacy) requirements. Non-compliance may result in legal penalties or reputational damage.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-24084. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart