Vulnerability Name:

CVE-2019-18991 (CCN-189321)

Assigned:2019-11-15
Published:2020-09-28
Updated:2021-07-21
Summary:A partial authentication bypass vulnerability exists on Atheros AR9132 3.60(AMX.8), AR9283 1.85, and AR9285 1.0.0.12NA devices. The vulnerability allows sending an unencrypted data frame to a WPA2-protected WLAN router where the packet is routed through the network. If successful, a response is sent back as an encrypted frame, which would allow an attacker to discern information or potentially modify data.
CVSS v3 Severity:5.4 Medium (CVSS v3.1 Vector: CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N)
4.8 Medium (Temporal CVSS v3.1 Vector: CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N/E:U/RL:U/RC:R)
Exploitability Metrics:Attack Vector (AV): Adjacent
Attack Complexity (AC): Low
Privileges Required (PR): None
User Interaction (UI): None
Scope:Scope (S): Unchanged
Impact Metrics:Confidentiality (C): Low
Integrity (I): Low
Availibility (A): None
6.5 Medium (CCN CVSS v3.1 Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N)
5.7 Medium (CCN Temporal CVSS v3.1 Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N/E:U/RL:U/RC:R)
Exploitability Metrics:Attack Vector (AV): Network
Attack Complexity (AC): Low
Privileges Required (PR): None
User Interaction (UI): None
Scope:Scope (S): Unchanged
Impact Metrics:Confidentiality (C): Low
Integrity (I): Low
Availibility (A): None
CVSS v2 Severity:4.8 Medium (CVSS v2 Vector: AV:A/AC:L/Au:N/C:P/I:P/A:N)
Exploitability Metrics:Access Vector (AV): Adjacent_Network
Access Complexity (AC): Low
Authentication (Au): None
Impact Metrics:Confidentiality (C): Partial
Integrity (I): Partial
Availibility (A): None
6.4 Medium (CCN CVSS v2 Vector: AV:N/AC:L/Au:N/C:P/I:P/A:N)
Exploitability Metrics:Access Vector (AV): Network
Access Complexity (AC): Low
Athentication (Au): None
Impact Metrics:Confidentiality (C): Partial
Integrity (I): Partial
Availibility (A): None
Vulnerability Type:CWE-287
Vulnerability Consequences:Bypass Security
References:Source: MITRE
Type: CNA
CVE-2019-18991

Source: XF
Type: UNKNOWN
atheros-cve201918991-sec-bypass(189321)

Source: CCN
Type: Qualcomm Web site
Wi-Fi products that anticipate, adapt, and amplify

Source: CCN
Type: Software Integrity Blog, Monday, September 28th, 2020
Authentication bypass vulnerabilities in multiple wireless router chipsets (CVE-2019-18989, CVE-2019-18990, and CVE-2019-18991)

Source: MISC
Type: Third Party Advisory
https://www.synopsys.com/blogs/software-security/cyrc-advisory-sept2020/

Vulnerable Configuration:Configuration 1:
  • cpe:/o:qualcomm:atheros_ar9132_firmware:3.60(amx.8):*:*:*:*:*:*:*
  • AND
  • cpe:/h:qualcomm:atheros_ar9132:-:*:*:*:*:*:*:*

    • Configuration 2:
  • cpe:/o:qualcomm:atheros_ar9283_firmware:1.85:*:*:*:*:*:*:*
  • AND
  • cpe:/h:qualcomm:atheros_ar9283:-:*:*:*:*:*:*:*

    • Configuration 3:
  • cpe:/o:qualcomm:atheros_ar9285_firmware:1.0.0.12na:*:*:*:*:*:*:*
  • AND
  • cpe:/h:qualcomm:atheros_ar9285:-:*:*:*:*:*:*:*

    • * Denotes that component is vulnerable
    BACK
    qualcomm atheros ar9132 firmware 3.60(amx.8)
    qualcomm atheros ar9132 -
    qualcomm atheros ar9283 firmware 1.85
    qualcomm atheros ar9283 -
    qualcomm atheros ar9285 firmware 1.0.0.12na
    qualcomm atheros ar9285 -