CVE-2019-5055: Null Pointer Dereference

Published Sep 11, 2019

Updated

An exploitable denial-of-service vulnerability exists in the Host Access Point Daemon (hostapd) on the NETGEAR N300 (WNR2000v5 with Firmware Version V1.0.0.70) wireless router. A SOAP request sent in an invalid sequence to the <WFAWLANConfig:1#PutMessage> service can cause a null pointer dereference, resulting in the hostapd service crashing. An unauthenticated attacker can send a specially-crafted SOAP request to trigger this vulnerability.

Affected Software

2 affected components

Netgear Wnr2000 Firmware=1.0.0.70

Netgear WNR2000=v5

Event History

Sep 11, 2019

CVE Published

via MITRE·09:10 PM

Data Sourced

via MITRE·09:10 PM

DescriptionSeverityWeakness

Frequently Asked Questions

What is the severity of CVE-2019-5055?

CVE-2019-5055 has a severity rating that indicates it can lead to a denial-of-service condition.

How do I fix CVE-2019-5055?

To fix CVE-2019-5055, users should update the firmware of the NETGEAR N300 (WNR2000v5) to the latest version.

What devices are affected by CVE-2019-5055?

The affected device for CVE-2019-5055 is the NETGEAR N300 (WNR2000v5) running firmware version V1.0.0.70.

What type of attack does CVE-2019-5055 facilitate?

CVE-2019-5055 facilitates a denial-of-service attack through improperly sequenced SOAP requests.

Is there a workaround for CVE-2019-5055?

There are no documented workarounds for CVE-2019-5055, and upgrading the firmware is the recommended solution.