IM
IronMonkey Threat Research

CVE-2019-15126 LOW

Published: 2020-02-05 | Last Modified: 2024-11-21 | Status: Modified

Description

An issue was discovered on Broadcom Wi-Fi client devices. Specifically timed and handcrafted traffic can cause internal errors (related to state transitions) in a WLAN device that lead to improper layer 2 Wi-Fi encryption with a consequent possibility of information disclosure over the air for a discrete set of traffic, a different vulnerability than CVE-2019-9500, CVE-2019-9501, CVE-2019-9502, and CVE-2019-9503.

Additional Descriptions (1)

Se detectó un problema en los dispositivos cliente de Broadcom Wi-Fi. Específicamente un tráfico diseñado minuciosamente y sincronizado puede causar errores internos (relacionados con las transiciones de estado) en un dispositivo WLAN que conllevan a un cifrado de Wi-Fi de Capa 2 inapropiado con una consiguiente posibilidad de divulgación de información por medio del aire para un conjunto de tráfico discreto, una vulnerabilidad diferente de CVE-2019-9500, CVE-2019-9501, CVE-2019-9502 y CVE-2019-9503.

CVSS Metrics

Base Score: 3.1 (LOW)

CVSS:3.1/AV:A/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N

Attack VectorADJACENT_NETWORK
Attack ComplexityHIGH
Privileges RequiredNONE
User InteractionNONE
ScopeUNCHANGED
Confidentiality ImpactLOW
Integrity ImpactNONE
Availability ImpactNONE

Source: [email protected]

Type: Primary

Exploitability Score: 1.6

Impact Score: 1.4

Base Score: 2.9 (LOW)

AV:A/AC:M/Au:N/C:P/I:N/A:N

Access VectorADJACENT_NETWORK
Access ComplexityMEDIUM
AuthenticationNONE
Confidentiality ImpactPARTIAL
Integrity ImpactNONE
Availability ImpactNONE

Source: [email protected]

Type: Primary

Exploitability Score: 5.5

Impact Score: 2.9

Weaknesses

Source Type Description
[email protected] Primary
en CWE-367

Affected Products

Vendor Product Version Update Type
apple ipados * <built-in method update of dict object at 0x7c3bf2b251c0> Operating System
apple iphone_os * <built-in method update of dict object at 0x7c3bf3a26b80> Operating System
apple mac_os_x * <built-in method update of dict object at 0x7c3bf3e5cb00> Operating System
broadcom bcm4389_firmware - <built-in method update of dict object at 0x7c3bf3b68980> Operating System
broadcom bcm43012_firmware - <built-in method update of dict object at 0x7c3bf2b27a40> Operating System
broadcom bcm43013_firmware - <built-in method update of dict object at 0x7c3bf2b26580> Operating System
broadcom bcm4375_firmware - <built-in method update of dict object at 0x7c3c48298240> Operating System
broadcom bcm43752_firmware - <built-in method update of dict object at 0x7c3bf3b69840> Operating System
broadcom bcm4356_firmware - <built-in method update of dict object at 0x7c3c47783380> Operating System

Affected Configurations

Operator: OR

Vulnerable CPE
Yes cpe:2.3:o:apple:ipados:*:*:*:*:*:*:*:*
Yes cpe:2.3:o:apple:iphone_os:*:*:*:*:*:*:*:*
Yes cpe:2.3:o:apple:mac_os_x:*:*:*:*:*:*:*:*

Operator: OR

Vulnerable CPE
Yes cpe:2.3:o:broadcom:bcm4389_firmware:-:*:*:*:*:*:*:*

Operator: OR

Vulnerable CPE
No cpe:2.3:h:broadcom:bcm4389:-:*:*:*:*:*:*:*

Operator: OR

Vulnerable CPE
Yes cpe:2.3:o:broadcom:bcm43012_firmware:-:*:*:*:*:*:*:*

Operator: OR

Vulnerable CPE
No cpe:2.3:h:broadcom:bcm43012:-:*:*:*:*:*:*:*

Operator: OR

Vulnerable CPE
Yes cpe:2.3:o:broadcom:bcm43013_firmware:-:*:*:*:*:*:*:*

Operator: OR

Vulnerable CPE
No cpe:2.3:h:broadcom:bcm43013:-:*:*:*:*:*:*:*

Operator: OR

Vulnerable CPE
Yes cpe:2.3:o:broadcom:bcm4375_firmware:-:*:*:*:*:*:*:*

Operator: OR

Vulnerable CPE
No cpe:2.3:h:broadcom:bcm4375:-:*:*:*:*:*:*:*

Operator: OR

Vulnerable CPE
Yes cpe:2.3:o:broadcom:bcm43752_firmware:-:*:*:*:*:*:*:*

Operator: OR

Vulnerable CPE
No cpe:2.3:h:broadcom:bcm43752:-:*:*:*:*:*:*:*

Operator: OR

Vulnerable CPE
Yes cpe:2.3:o:broadcom:bcm4356_firmware:-:*:*:*:*:*:*:*

Operator: OR

Vulnerable CPE
No cpe:2.3:h:broadcom:bcm4356:-:*:*:*:*:*:*:*

References

Notification
Message here