CVE-2019-12588: Input Validation
The client 802.11 mac implementation in Espressif ESP8266NONOSSDK 2.2.0 through 3.1.0 does not validate correctly the RSN AuthKey suite list count in beacon frames, probe responses, and association responses, which allows attackers in radio range to cause a denial of service (crash) via a crafted message.
Affected Software
Event History
Frequently Asked Questions
What is CVE-2019-12588?
CVE-2019-12588 is a vulnerability in the client 802.11 mac implementation in Espressif ESP8266_NONOS_SDK 2.2.0 through 3.1.0 that allows attackers in radio range to cause a denial of service (crash) via a crafted beacon frame, probe response, or association response.
How does CVE-2019-12588 impact me?
CVE-2019-12588 can impact you if you are using Espressif ESP8266_NONOS_SDK version 2.2.0 through 3.1.0. Attackers in radio range can crash your system by sending crafted beacon frames, probe responses, or association responses.
What is the severity of CVE-2019-12588?
CVE-2019-12588 has a severity of medium (6.5).
How can I fix CVE-2019-12588?
To fix CVE-2019-12588, you should upgrade to a version of Espressif ESP8266_NONOS_SDK that is not affected by the vulnerability.
Where can I find more information about CVE-2019-12588?
You can find more information about CVE-2019-12588 on the following references: - [GitHub - Matheus-Garbelini/esp32_esp8266_attacks](https://github.com/Matheus-Garbelini/esp32_esp8266_attacks) - [GitHub - Espressif](https://github.com/espressif) - [Blog post by Matheus Garbelini](https://matheus-garbelini.github.io/home/post/esp8266-beacon-frame-crash/)