CVE-2019-15126

An issue was discovered on Broadcom Wi-Fi client devices. Specifically timed and handcrafted traffic can cause internal errors (related to state transitions) in a WLAN device that lead to improper layer 2 Wi-Fi encryption with a consequent possibility of information disclosure over the air for a discrete set of traffic, a different vulnerability than CVE-2019-9500, CVE-2019-9501, CVE-2019-9502, and CVE-2019-9503.

CVSS v3.1

3.1 LOWCVSS:3.1/AV:A/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N

CVSS v2.0

2.9 LOWAV:A/AC:M/Au:N/C:P/I:N/A:N

EPSS

7.31% chance of exploitation in the next 30 days, 94th percentile

Published

2020-02-05

Updated

2024-08-05

Proof-of-concept exploits (5)

• http://packetstormsecurity.com/files/156809/Broadcom-Wi-Fi-KR00K-Proof-Of-Concept.html
• 0x13enny/kr00k13★ · 2020-03-19
• EaglerLight/wifi_poc0★ · 2021-05-07
• akabe1/kr00ker66★ · 2022-01-19
• hexway/r00kie-kr00kie224★ · 2020-03-22

ExploitDB entries (1)

• https://www.exploit-db.com/exploits/48233

References

• CVE Record
• NVD entry

Related

• CVE-2024-28116
• CVE-2019-15120
• CVE-2019-15128
• CVE-2019-15107
• CVE-2019-15129
• CVE-2019-15106