diff --git a/board/qca/arm/common/cmd_bootqca.c b/board/qca/arm/common/cmd_bootqca.c
index e1329f6aa7..9e51bb121d 100644
--- a/board/qca/arm/common/cmd_bootqca.c
+++ b/board/qca/arm/common/cmd_bootqca.c
@@ -365,13 +365,16 @@ int config_select(unsigned int addr, char *rcmd, int rcmd_size)
 			return -1;
 		}
 
-		sprintf((char *)dtb_config_name, "%s", config);
+		snprintf((char *)dtb_config_name,
+			 sizeof(dtb_config_name), "%s", config);
 
 		ipq_smem_get_socinfo_version((uint32_t *)&soc_version);
 		if(SOCINFO_VERSION_MAJOR(soc_version) >= 2) {
-			sprintf(dtb_config_name + strlen("config@"), "v%d.0-%s",
-					SOCINFO_VERSION_MAJOR(soc_version),
-					config + strlen("config@"));
+			snprintf(dtb_config_name + strlen("config@"),
+				 sizeof(dtb_config_name) - strlen("config@"),
+				 "v%d.0-%s",
+				 SOCINFO_VERSION_MAJOR(soc_version),
+				 config + strlen("config@"));
 		}
 	}
 
@@ -417,7 +420,8 @@ static int do_boot_signedimg(cmd_tbl_t *cmdtp, int flag, int argc, char *const a
 		if (debug) {
 			printf("Using nand device %d\n", CONFIG_SPI_FLASH_INFO_IDX);
 		}
-		sprintf(runcmd, "nand device %d", CONFIG_SPI_FLASH_INFO_IDX);
+		snprintf(runcmd, sizeof(runcmd),
+			 "nand device %d", CONFIG_SPI_FLASH_INFO_IDX);
 		run_command(runcmd, 0);
 
 	} else if (sfi->flash_type == SMEM_BOOT_NAND_FLASH) {
diff --git a/board/qca/arm/ipq807x/ipq807x.c b/board/qca/arm/ipq807x/ipq807x.c
index 28829200c7..a77bd21200 100644
--- a/board/qca/arm/ipq807x/ipq807x.c
+++ b/board/qca/arm/ipq807x/ipq807x.c
@@ -540,7 +540,7 @@ void board_pci_init(int id)
 	int node, gpio_node;
 	char name[16];
 
-	sprintf(name, "pci%d", id);
+	snprintf(name, sizeof(name), "pci%d", id);
 	node = fdt_path_offset(gd->fdt_blob, name);
 	if (node < 0) {
 		printf("Could not find PCI in device tree\n");
@@ -562,7 +562,7 @@ void board_pci_deinit()
 	struct fdt_resource pci_phy;
 
 	for (i = 0; i < PCI_MAX_DEVICES; i++) {
-		sprintf(name, "pci%d", i);
+		snprintf(name, sizeof(name), "pci%d", i);
 		node = fdt_path_offset(gd->fdt_blob, name);
 		if (node < 0) {
 			printf("Could not find PCI in device tree\n");