CVE-2023-43551 is a critical severity (9.1) authentication bypass flaw in Qualcomm chipset software, in the modem code during an LTE attach, where a rogue base station can skip authentication. Qualcomm published it in its June 2024 security bulletin. The record names no fixed version, so get the fix from your device or module maker.
What's affected
The NVD record lists Qualcomm hardware and firmware, including 315 5G IOT MODEM, 9205 LTE MODEM. The record shows 2 hardware entries in its machine readable data, and the Qualcomm bulletin carries the authoritative chipset list. Use that list, not this page, to decide whether a product is in scope.
The record does not name a fixed version. Qualcomm bulletins describe fixes that are delivered to device makers, so the practical fix for you is a firmware or operating system update from whoever made the device, phone, module or vehicle unit.
NVD scores the flaw 9.1 (Critical). The vector is CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N. In plain terms the attack is made over the network, attack complexity is low, it needs no privileges, and it needs no user interaction. Impact on confidentiality is high, on integrity high and on availability no.
We could not load the Qualcomm bulletin text when preparing this page, because the site renders its tables with scripts. Qualcomm's own severity rating and patch details should be read on the bulletin itself. If it differs from the NVD score above, trust the bulletin for Qualcomm's view and use the NVD score for comparison across CVEs.
The weakness is tagged CWE-287.
How to check if you're exposed
For an Android device you control, the security patch level is a quick first signal:
adb shell getprop ro.build.version.security_patch
Compare that date with your device maker's own security bulletin for the same month. Do not assume a patch level covers this CVE until the maker's bulletin lists it. For routers, modules, telematics units, vehicles and other embedded hardware, there is usually no package manager to query. Ask the supplier which Qualcomm chipset the product uses and whether the June 2024 Qualcomm fixes are included in the firmware you run.
What to do now
- Read the Qualcomm bulletin linked in Sources and find this CVE in its table. Confirm the chipsets and the severity Qualcomm assigns.
- List the phones, modules, gateways and embedded devices in your estate that use Qualcomm silicon. Your hardware inventory or SBOM is the starting point.
- Ask each device maker whether its firmware includes the fix, and for the firmware version that does. Record the answer.
- Schedule the update. Until then, limit exposure of the affected interface to networks and peers you trust where the device allows it.
Why it matters
CWE-287 is improper authentication. The code does not properly verify who or what it is talking to before it trusts them.
The record has only a one line description, and Qualcomm's wording is similarly brief. We will not add detail beyond what the sources say. On access, the vector says the attack does not need an account first. The base score is 9.1, rated critical by NVD. Bugs of this type sit in low level firmware and driver code, which is why a fix reaches you slowly. It passes from the chip vendor to the device maker, and then to you.
The record does not mark this CVE as being in the CISA Known Exploited Vulnerabilities catalog, and no source we could read says it is exploited in the wild.
Try it yourself
Scanning is quicker than reading advisories. The free in-browser dependency scan at gold.safeguard.sh/scan and the Gold directory help you see what you run. This demo shows the workflow.
Click through it at your own pace, or open it full screen.
Quick check
Is CVE-2023-43551 exploited in the wild?
The record does not flag it as a CISA Known Exploited Vulnerability, and the sources we could read do not report exploitation. That can change, so check the Gold page for current status.
Who ships the fix for CVE-2023-43551?
Qualcomm supplies fixes to its customers. You get the fix through a firmware or operating system update from the maker of your device or module.
Sources
Last reviewed: 19 October 2026.
