CVE-2023-43511 is a high severity (CVSS 7.5) flaw in Qualcomm WLAN firmware. Parsing an IPv6 extension header can cause a transient denial of service when the firmware receives an IPv6 packet whose next header is IPPROTO_NONE. Qualcomm's January 2024 bulletin covers it. Ask your device maker for the patched firmware.
What's affected
The record lists Qualcomm chipset firmware, including the 315 5G IoT modem and the 9206 LTE modem, among four product entries it shows. The full affected list is in Qualcomm's bulletin, which the record references. The bulletin page loads its content with scripts, so I could not read its text when I fetched it. The statements on this page come from the NVD record only.
Because chipset fixes are built into device firmware, the version you need depends on the phone, router, module or vehicle unit that contains the chip. The bulletin is the reference for which Qualcomm products are affected. Your device maker's own security notes say which firmware build carries the fix for your model.
The weakness is CWE-835, a loop with an exit condition that cannot be reached. The vector is network based, needs no account and no interaction, and affects availability only. Qualcomm describes the effect as a transient denial of service.
How to check if you're exposed
You cannot check this with a package manager, because the code is in the wireless firmware. Start from your inventory of devices that contain Qualcomm WLAN or modem chipsets, such as phones, routers, IoT modules and access points. Then compare the firmware or software build of each device with your vendor's security notes.
On an Android phone, the security patch level is in Settings, About phone, Android version. A patch level at or after the month the vendor lists for this CVE is the usual sign that the fix is in. On network gear, read the firmware version from its admin page.
What to do now
- List the devices in your estate that use Qualcomm WLAN or modem chipsets, starting with the models named in the bulletin.
- Read the Qualcomm January 2024 bulletin for the affected products.
- Ask each device vendor which firmware build includes the fix and apply it.
- Prioritize devices that must stay reachable, such as IoT gateways and field routers.
- Segment IoT networks so that a crash of one device does not take down others.
- Record devices that no longer receive firmware updates, and plan their replacement.
Why it matters
An infinite loop in firmware is a denial of service by design: a packet reaches a parsing routine, the routine never finishes, and the radio stops doing its job until it recovers. The record's class, CWE-835, is exactly that, and the packet needs no login.
The impact is limited to availability, and Qualcomm says the denial of service is transient, so the device recovers. Even so, a remote party who can reach the device over its wireless link could repeat the trigger. For IoT and field devices where uptime matters, that is worth a firmware update. The KEV flag is false.
Quick check
Is the denial of service permanent?
Qualcomm's description calls it transient, which means the device recovers. The attack could be repeated, though.
Sources
Last reviewed: 19 October 2026.
