CVE-2019-6496
CVSS2
Attack Vector
ADJACENT_NETWORK
Attack Complexity
LOW
Authentication
NONE
Confidentiality Impact
COMPLETE
Integrity Impact
COMPLETE
Availability Impact
COMPLETE
AV:A/AC:L/Au:N/C:C/I:C/A:C
CVSS3
Attack Vector
ADJACENT
Attack Complexity
LOW
Privileges Required
NONE
User Interaction
NONE
Scope
UNCHANGED
Confidentiality Impact
HIGH
Integrity Impact
HIGH
Availability Impact
HIGH
CVSS:3.0/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
AI Score
Confidence
High
EPSS
Percentile
87.7%
The ThreadX-based firmware on Marvell Avastar Wi-Fi devices, models 88W8787, 88W8797, 88W8801, 88W8897, and 88W8997, allows remote attackers to execute arbitrary code or cause a denial of service (block pool overflow) via malformed Wi-Fi packets during identification of available Wi-Fi networks. Exploitation of the Wi-Fi device can lead to exploitation of the host application processor in some cases, but this depends on several factors including host OS hardening and the availability of DMA.
Affected configurations
| Vendor | Product | Version | CPE |
|---|---|---|---|
| marvell | 88w8787_firmware | - | cpe:2.3:o:marvell:88w8787_firmware:-:*:*:*:*:*:*:* |
| marvell | 88w8787 | - | cpe:2.3:h:marvell:88w8787:-:*:*:*:*:*:*:* |
| marvell | 88w8797_firmware | - | cpe:2.3:o:marvell:88w8797_firmware:-:*:*:*:*:*:*:* |
| marvell | 88w8797 | - | cpe:2.3:h:marvell:88w8797:-:*:*:*:*:*:*:* |
| marvell | 88w8801_firmware | - | cpe:2.3:o:marvell:88w8801_firmware:-:*:*:*:*:*:*:* |
| marvell | 88w8801 | - | cpe:2.3:h:marvell:88w8801:-:*:*:*:*:*:*:* |
| marvell | 88w8897_firmware | - | cpe:2.3:o:marvell:88w8897_firmware:-:*:*:*:*:*:*:* |
| marvell | 88w8897 | - | cpe:2.3:h:marvell:88w8897:-:*:*:*:*:*:*:* |
| marvell | 88w8997_firmware | - | cpe:2.3:o:marvell:88w8997_firmware:-:*:*:*:*:*:*:* |
| marvell | 88w8997 | - | cpe:2.3:h:marvell:88w8997:-:*:*:*:*:*:*:* |
References
www.securityfocus.com/bid/106865
2018.zeronights.ru/wp-content/uploads/materials/19-Researching-Marvell-Avastar-Wi-Fi.pdf
embedi.org/blog/remotely-compromise-devices-by-using-bugs-in-marvell-avastar-wi-fi-from-zero-knowledge-to-zero-click-rce/
www.kb.cert.org/vuls/id/730261/
www.scribd.com/document/398350818/WiFi-CVE-2019-6496-Marvell-s-Statement
www.synology.com/security/advisory/Synology_SA_19_07
www.zdnet.com/article/wifi-firmware-bug-affects-laptops-smartphones-routers-gaming-devices/
Related
CVSS2
Attack Vector
ADJACENT_NETWORK
Attack Complexity
LOW
Authentication
NONE
Confidentiality Impact
COMPLETE
Integrity Impact
COMPLETE
Availability Impact
COMPLETE
AV:A/AC:L/Au:N/C:C/I:C/A:C
CVSS3
Attack Vector
ADJACENT
Attack Complexity
LOW
Privileges Required
NONE
User Interaction
NONE
Scope
UNCHANGED
Confidentiality Impact
HIGH
Integrity Impact
HIGH
Availability Impact
HIGH
CVSS:3.0/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
AI Score
Confidence
High
EPSS
Percentile
87.7%