Broadcom wl driver is vulnerable to heap buffer overflow

Published 6 y ago 2020-02-03 · modified 4 mo ago 2026-06-17 · JSON

CVSS

7.9

v3.1 · CNA

CISA KEV

not known exploited

EPSS

2.6%

percentile 85%

Public exploits

none known

The Broadcom wl WiFi driver is vulnerable to a heap buffer overflow. If the vendor information element data length is larger than 164 bytes, a heap buffer overflow is triggered in wlc_wpa_plumb_gtk. In the worst case scenario, by sending specially-crafted WiFi packets, a remote, unauthenticated attacker may be able to execute arbitrary code on a vulnerable system. More typically, this vulnerability will result in denial-of-service conditions.

Exploit prediction (EPSS)

2.60% probability of exploitation in the next 30 days, higher than 85% of all scored CVEs.

CVSS scores

Assigned by	Version	Score	Vector
CNA	3.1	7.9	`CVSS:3.1/AV:A/AC:H/PR:N/UI:R/S:C/C:H/I:H/A:H`
CNA	3.1	7.9	`CVSS:3.1/AV:A/AC:H/PR:N/UI:R/S:C/C:H/I:H/A:H`
NVD	3.1	8.8	`CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H`
NVD	2.0	8.3	`AV:A/AC:L/Au:N/C:C/I:C/A:C`

Affected products

Broadcom WiFi drivers

Classification

Weakness

CWE-122 Heap-based Buffer Overflow
CWE-787 Out-of-bounds Write

References

blog.quarkslab.com /reverse-engineering-broadcom-wireless-chipsets.html · x_refsource_MISC, x_transferred
kb.cert.org /vuls/id/166939/ · x_refsource_MISC, x_transferred

Sources

CVE List: CVE-2019-9502
NVD: CVE-2019-9502

vulnwire keeps one entry per vulnerability: the CVE id wins, then GHSA; records that alias each other are merged. Machine-readable: JSON.