CVE-2019-15126

—

CVSS 3.1

3.1 low

EPSS

7%p94

Published

Feb 5, 2020 (Feb 5, 2020)

Modified

Jun 17, 2026

Description

An issue was discovered on Broadcom Wi-Fi client devices. Specifically timed and handcrafted traffic can cause internal errors (related to state transitions) in a WLAN device that lead to improper layer 2 Wi-Fi encryption with a consequent possibility of information disclosure over the air for a discrete set of traffic, a different vulnerability than CVE-2019-9500, CVE-2019-9501, CVE-2019-9502, and CVE-2019-9503.

Vendors: apple broadcom
Products: ipados, iphone os, mac os x, bcm4389 firmware, bcm43012 firmware, bcm43013 firmware, bcm4375 firmware, bcm43752 firmware, bcm4356 firmware
Weakness: CWE-367
Vector: CVSS:3.1/AV:A/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N

NVD CVE.org GitHub PoCs EPSS (7.3%)

In the news6 stories

Week in review: Attackers probing for vulnerable Exchange servers, RSA Conference 2020 coverage

Help Net SecurityMar 1, 00:00 UTC · Mar 1, 2020Ransomware in the wildCVE-2020-0688 CVE-2020-6418 CVE-2019-15126

60

Qualcomm and MediaTek Wi-Fi chips impacted by Kr00k

Security AffairsAug 8, 07:58 UTC · Aug 8, 2020Vulnerability CVE-2019-15126 CVE-2020-3702

47

Kr00k Wi-Fi Encryption flaw affects more than a Billion devices

Security AffairsFeb 26, 20:07 UTC · Feb 26, 2020Vulnerability CVE-2019-15126

47

New Wi-Fi Encryption Vulnerability Affects Over A Billion Devices

The Hacker NewsFeb 26, 18:15 UTC · Feb 26, 2020Vulnerability CVE-2019-15126

47

Flaw affecting 1B+ Wi-Fi-enabled devices allows attackers to decrypt wireless network packets

Help Net SecurityMar 23, 11:42 UTC · Mar 23, 2020Vulnerability CVE-2019-15126

35

Wi-Fi Chip Vulnerability

Schneier on SecurityMar 3, 06:43 UTC · Mar 3, 2020Vulnerability CVE-2019-15126

35