CVE-2020-28349

An inaccurate frame deduplication process in ChirpStack Network Server 3.9.0 allows a malicious gateway to perform uplink Denial of Service via malformed frequency attributes in CollectAndCallOnceCollect in internal/uplink/collect.go. NOTE: the vendor's position is that there are no "guarantees that allowing untrusted LoRa gateways to the network should still result in a secure network.

CVSS v3.1

6.5 MEDIUMCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

CVSS v2.0

6.8 MEDIUMAV:N/AC:L/Au:S/C:N/I:N/A:C

EPSS

2.20% chance of exploitation in the next 30 days, 81th percentile

Published

2020-11-09

Updated

2024-08-04

Proof-of-concept exploits (1)

• https://www.cyberark.com/resources/threat-research-blog/lorawan-mqtt-what-to-know-when-se…

References

• CVE Record
• NVD entry

Related

• CVE-2020-28347
• CVE-2020-28351
• CVE-2020-28337
• CVE-2020-28361
• CVE-2020-28334
• CVE-2020-28373