CVE-2018-19860

CVSS V2 Medium 5.8 CVSS V3 High 8.8
Description
Broadcom firmware before summer 2014 on Nexus 5 BCM4335C0 2012-12-11, Raspberry Pi 3 BCM43438A1 2014-06-02, and unspecifed other devices does not properly restrict LMP commnds and executes certain memory contents upon receiving an LMP command, as demonstrated by executing an HCI command.
Overview
  • CVE ID
  • CVE-2018-19860
  • Assigner
  • cve@mitre.org
  • Vulnerability Status
  • Modified
  • Published Version
  • 2019-06-07T17:29:00
  • Last Modified Date
  • 2020-08-24T17:37:01
Weakness Enumerations
CWE URL
CWE-732 http://cwe.mitre.org/data/definitions/732.html
CPE Configuration (Product)
CPE Vulnerable Operator Version Start Version End
AND
cpe:2.3:o:broadcom:bcm4335c0_firmware:2012-12-11:*:*:*:*:*:*:* 1 OR
cpe:2.3:h:broadcom:bcm4335c0:-:*:*:*:*:*:*:* 0 OR
AND
cpe:2.3:o:broadcom:bcm43438a1_firmware:2014-06-02:*:*:*:*:*:*:* 1 OR
cpe:2.3:h:broadcom:bcm43438a1:-:*:*:*:*:*:*:* 0 OR
AND
cpe:2.3:o:cypress:cyw20702a1kwfbg_firmware:-:*:*:*:*:*:*:* 1 OR
cpe:2.3:h:cypress:cyw20702a1kwfbg:-:*:*:*:*:*:*:* 0 OR
AND
cpe:2.3:o:cypress:cyw20702a1kwfbgt_firmware:-:*:*:*:*:*:*:* 1 OR
cpe:2.3:h:cypress:cyw20702a1kwfbgt:-:*:*:*:*:*:*:* 0 OR
AND
cpe:2.3:o:cypress:cyw20702b0kwfbg_firmware:-:*:*:*:*:*:*:* 1 OR
cpe:2.3:h:cypress:cyw20702b0kwfbg:-:*:*:*:*:*:*:* 0 OR
AND
cpe:2.3:o:cypress:cyw20702b0kwfbgt_firmware:-:*:*:*:*:*:*:* 1 OR
cpe:2.3:h:cypress:cyw20702b0kwfbgt:-:*:*:*:*:*:*:* 0 OR
AND
cpe:2.3:o:cypress:cyw20703ua1kffb1g_firmware:-:*:*:*:*:*:*:* 1 OR
cpe:2.3:h:cypress:cyw20703ua1kffb1g:-:*:*:*:*:*:*:* 0 OR
AND
cpe:2.3:o:cypress:cyw20703ua1kffb1gt_firmware:-:*:*:*:*:*:*:* 1 OR
cpe:2.3:h:cypress:cyw20703ua1kffb1gt:-:*:*:*:*:*:*:* 0 OR
AND
cpe:2.3:o:cypress:cyw20704ua1kffb1g_firmware:-:*:*:*:*:*:*:* 1 OR
cpe:2.3:h:cypress:cyw20704ua1kffb1g:-:*:*:*:*:*:*:* 0 OR
AND
cpe:2.3:o:cypress:cyw20704ua1kffb1gt_firmware:-:*:*:*:*:*:*:* 1 OR
cpe:2.3:h:cypress:cyw20704ua1kffb1gt:-:*:*:*:*:*:*:* 0 OR
AND
cpe:2.3:o:cypress:cyw20704ua2kffb1g_firmware:-:*:*:*:*:*:*:* 1 OR
cpe:2.3:h:cypress:cyw20704ua2kffb1g:-:*:*:*:*:*:*:* 0 OR
AND
cpe:2.3:o:cypress:cyw20704ua2kffb1gt_firmware:-:*:*:*:*:*:*:* 1 OR
cpe:2.3:h:cypress:cyw20704ua2kffb1gt:-:*:*:*:*:*:*:* 0 OR
AND
cpe:2.3:o:cypress:cyw20705a1kwfbgt_firmware:-:*:*:*:*:*:*:* 1 OR
cpe:2.3:h:cypress:cyw20705a1kwfbgt:-:*:*:*:*:*:*:* 0 OR
AND
cpe:2.3:o:cypress:cyw20705b0kwfbg_firmware:-:*:*:*:*:*:*:* 1 OR
cpe:2.3:h:cypress:cyw20705b0kwfbg:-:*:*:*:*:*:*:* 0 OR
AND
cpe:2.3:o:cypress:cyw20705b0kwfbgt_firmware:-:*:*:*:*:*:*:* 1 OR
cpe:2.3:h:cypress:cyw20705b0kwfbgt:-:*:*:*:*:*:*:* 0 OR
AND
cpe:2.3:o:cypress:cyw20706ua1kffb1g_firmware:-:*:*:*:*:*:*:* 1 OR
cpe:2.3:h:cypress:cyw20706ua1kffb1g:-:*:*:*:*:*:*:* 0 OR
AND
cpe:2.3:o:cypress:cyw20706ua1kffb1gt_firmware:-:*:*:*:*:*:*:* 1 OR
cpe:2.3:h:cypress:cyw20706ua1kffb1gt:-:*:*:*:*:*:*:* 0 OR
AND
cpe:2.3:o:cypress:cyw20706ua1kffb4g_firmware:-:*:*:*:*:*:*:* 1 OR
cpe:2.3:h:cypress:cyw20706ua1kffb4g:-:*:*:*:*:*:*:* 0 OR
AND
cpe:2.3:o:cypress:cyw20706ua2kffb4g_firmware:-:*:*:*:*:*:*:* 1 OR
cpe:2.3:h:cypress:cyw20706ua2kffb4g:-:*:*:*:*:*:*:* 0 OR
AND
cpe:2.3:o:cypress:cyw20706ua2kffb4gt_firmware:-:*:*:*:*:*:*:* 1 OR
cpe:2.3:h:cypress:cyw20706ua2kffb4gt:-:*:*:*:*:*:*:* 0 OR
AND
cpe:2.3:o:cypress:cyw20707a2kubgt_firmware:-:*:*:*:*:*:*:* 1 OR
cpe:2.3:h:cypress:cyw20707a2kubgt:-:*:*:*:*:*:*:* 0 OR
AND
cpe:2.3:o:cypress:cyw20707ua1kffb1g_firmware:-:*:*:*:*:*:*:* 1 OR
cpe:2.3:h:cypress:cyw20707ua1kffb1g:-:*:*:*:*:*:*:* 0 OR
AND
cpe:2.3:o:cypress:cyw20707ua1kffb4g_firmware:-:*:*:*:*:*:*:* 1 OR
cpe:2.3:h:cypress:cyw20707ua1kffb4g:-:*:*:*:*:*:*:* 0 OR
AND
cpe:2.3:o:cypress:cyw20707ua1kffb4gt_firmware:-:*:*:*:*:*:*:* 1 OR
cpe:2.3:h:cypress:cyw20707ua1kffb4gt:-:*:*:*:*:*:*:* 0 OR
AND
cpe:2.3:o:cypress:cyw20707ua2kffb4g_firmware:-:*:*:*:*:*:*:* 1 OR
cpe:2.3:h:cypress:cyw20707ua2kffb4g:-:*:*:*:*:*:*:* 0 OR
AND
cpe:2.3:o:cypress:cyw20707ua2kffb4gt_firmware:-:*:*:*:*:*:*:* 1 OR
cpe:2.3:h:cypress:cyw20707ua2kffb4gt:-:*:*:*:*:*:*:* 0 OR
AND
cpe:2.3:o:cypress:cyw20707va1pkwbgt_firmware:-:*:*:*:*:*:*:* 1 OR
cpe:2.3:h:cypress:cyw20707va1pkwbgt:-:*:*:*:*:*:*:* 0 OR
AND
cpe:2.3:o:cypress:cyw20707va2pkwbgt_firmware:-:*:*:*:*:*:*:* 1 OR
cpe:2.3:h:cypress:cyw20707va2pkwbgt:-:*:*:*:*:*:*:* 0 OR
AND
cpe:2.3:o:cypress:cyw20730a1kfbg_firmware:-:*:*:*:*:*:*:* 1 OR
cpe:2.3:h:cypress:cyw20730a1kfbg:-:*:*:*:*:*:*:* 0 OR
AND
cpe:2.3:o:cypress:cyw20730a1kfbgt_firmware:-:*:*:*:*:*:*:* 1 OR
cpe:2.3:h:cypress:cyw20730a1kfbgt:-:*:*:*:*:*:*:* 0 OR
AND
cpe:2.3:o:cypress:cyw20730a1kml2g_firmware:-:*:*:*:*:*:*:* 1 OR
cpe:2.3:h:cypress:cyw20730a1kml2g:-:*:*:*:*:*:*:* 0 OR
AND
cpe:2.3:o:cypress:cyw20730a1kml2gt_firmware:-:*:*:*:*:*:*:* 1 OR
cpe:2.3:h:cypress:cyw20730a1kml2gt:-:*:*:*:*:*:*:* 0 OR
AND
cpe:2.3:o:cypress:cyw20730a1kmlg_firmware:-:*:*:*:*:*:*:* 1 OR
cpe:2.3:h:cypress:cyw20730a1kmlg:-:*:*:*:*:*:*:* 0 OR
AND
cpe:2.3:o:cypress:cyw20730a1kmlgt_firmware:-:*:*:*:*:*:*:* 1 OR
cpe:2.3:h:cypress:cyw20730a1kmlgt:-:*:*:*:*:*:*:* 0 OR
AND
cpe:2.3:o:cypress:cyw20730a2kfbg_firmware:-:*:*:*:*:*:*:* 1 OR
cpe:2.3:h:cypress:cyw20730a2kfbg:-:*:*:*:*:*:*:* 0 OR
AND
cpe:2.3:o:cypress:cyw20730a2kfbgt_firmware:-:*:*:*:*:*:*:* 1 OR
cpe:2.3:h:cypress:cyw20730a2kfbgt:-:*:*:*:*:*:*:* 0 OR
AND
cpe:2.3:o:cypress:cyw20730a2kml2g_firmware:-:*:*:*:*:*:*:* 1 OR
cpe:2.3:h:cypress:cyw20730a2kml2g:-:*:*:*:*:*:*:* 0 OR
AND
cpe:2.3:o:cypress:cyw20730a2kml2gt_firmware:-:*:*:*:*:*:*:* 1 OR
cpe:2.3:h:cypress:cyw20730a2kml2gt:-:*:*:*:*:*:*:* 0 OR
AND
cpe:2.3:o:cypress:cyw20733a1kfb1gt_firmware:-:*:*:*:*:*:*:* 1 OR
cpe:2.3:h:cypress:cyw20733a1kfb1gt:-:*:*:*:*:*:*:* 0 OR
AND
cpe:2.3:o:cypress:cyw20733a2kfb1g_firmware:-:*:*:*:*:*:*:* 1 OR
cpe:2.3:h:cypress:cyw20733a2kfb1g:-:*:*:*:*:*:*:* 0 OR
AND
cpe:2.3:o:cypress:cyw20733a2kfb1gt_firmware:-:*:*:*:*:*:*:* 1 OR
cpe:2.3:h:cypress:cyw20733a2kfb1gt:-:*:*:*:*:*:*:* 0 OR
AND
cpe:2.3:o:cypress:cyw20733a2kml1g_firmware:-:*:*:*:*:*:*:* 1 OR
cpe:2.3:h:cypress:cyw20733a2kml1g:-:*:*:*:*:*:*:* 0 OR
AND
cpe:2.3:o:cypress:cyw20733a2kml1gt_firmware:-:*:*:*:*:*:*:* 1 OR
cpe:2.3:h:cypress:cyw20733a2kml1gt:-:*:*:*:*:*:*:* 0 OR
AND
cpe:2.3:o:cypress:cyw20733a3kfb1g_firmware:-:*:*:*:*:*:*:* 1 OR
cpe:2.3:h:cypress:cyw20733a3kfb1g:-:*:*:*:*:*:*:* 0 OR
AND
cpe:2.3:o:cypress:cyw20733a3kfb1gt_firmware:-:*:*:*:*:*:*:* 1 OR
cpe:2.3:h:cypress:cyw20733a3kfb1gt:-:*:*:*:*:*:*:* 0 OR
AND
cpe:2.3:o:cypress:cyw20733a3kfb2gt_firmware:-:*:*:*:*:*:*:* 1 OR
cpe:2.3:h:cypress:cyw20733a3kfb2gt:-:*:*:*:*:*:*:* 0 OR
AND
cpe:2.3:o:cypress:cyw20733a3kml1g_firmware:-:*:*:*:*:*:*:* 1 OR
cpe:2.3:h:cypress:cyw20733a3kml1g:-:*:*:*:*:*:*:* 0 OR
AND
cpe:2.3:o:cypress:cyw20733a3kml1gt_firmware:-:*:*:*:*:*:*:* 1 OR
cpe:2.3:h:cypress:cyw20733a3kml1gt:-:*:*:*:*:*:*:* 0 OR
AND
cpe:2.3:o:cypress:cyw20734ua1kffb3g_firmware:-:*:*:*:*:*:*:* 1 OR
cpe:2.3:h:cypress:cyw20734ua1kffb3g:-:*:*:*:*:*:*:* 0 OR
AND
cpe:2.3:o:cypress:cyw20734ua1kffb3gt_firmware:-:*:*:*:*:*:*:* 1 OR
cpe:2.3:h:cypress:cyw20734ua1kffb3gt:-:*:*:*:*:*:*:* 0 OR
AND
cpe:2.3:o:cypress:cyw20734ua2kffb3g_firmware:-:*:*:*:*:*:*:* 1 OR
cpe:2.3:h:cypress:cyw20734ua2kffb3g:-:*:*:*:*:*:*:* 0 OR
AND
cpe:2.3:o:cypress:cyw20734ua2kffb3gt_firmware:-:*:*:*:*:*:*:* 1 OR
cpe:2.3:h:cypress:cyw20734ua2kffb3gt:-:*:*:*:*:*:*:* 0 OR
AND
cpe:2.3:o:cypress:cyw43438kubgt_firmware:-:*:*:*:*:*:*:* 1 OR
cpe:2.3:h:cypress:cyw43438kubgt:-:*:*:*:*:*:*:* 0 OR
AND
cpe:2.3:o:cypress:cyw4343w1kubgt_firmware:-:*:*:*:*:*:*:* 1 OR
cpe:2.3:h:cypress:cyw4343w1kubgt:-:*:*:*:*:*:*:* 0 OR
AND
cpe:2.3:o:cypress:cyw4343wkubgt_firmware:-:*:*:*:*:*:*:* 1 OR
cpe:2.3:h:cypress:cyw4343wkubgt:-:*:*:*:*:*:*:* 0 OR
AND
cpe:2.3:o:cypress:cyw4343wkwbgt_firmware:-:*:*:*:*:*:*:* 1 OR
cpe:2.3:h:cypress:cyw4343wkwbgt:-:*:*:*:*:*:*:* 0 OR
AND
cpe:2.3:o:cypress:cyw4354kkwbgt_firmware:-:*:*:*:*:*:*:* 1 OR
cpe:2.3:h:cypress:cyw4354kkwbgt:-:*:*:*:*:*:*:* 0 OR
AND
cpe:2.3:o:cypress:cyw4354xkubgt_firmware:-:*:*:*:*:*:*:* 1 OR
cpe:2.3:h:cypress:cyw4354xkubgt:-:*:*:*:*:*:*:* 0 OR
AND
cpe:2.3:o:cypress:cyw89071a1cubxgt_firmware:-:*:*:*:*:*:*:* 1 OR
cpe:2.3:h:cypress:cyw89071a1cubxgt:-:*:*:*:*:*:*:* 0 OR
AND
cpe:2.3:o:cypress:cyw89072brfb5g_firmware:-:*:*:*:*:*:*:* 1 OR
cpe:2.3:h:cypress:cyw89072brfb5g:-:*:*:*:*:*:*:* 0 OR
AND
cpe:2.3:o:cypress:cyw89072brfb5gt_firmware:-:*:*:*:*:*:*:* 1 OR
cpe:2.3:h:cypress:cyw89072brfb5gt:-:*:*:*:*:*:*:* 0 OR
AND
cpe:2.3:o:cypress:cyw89335l2cubgt_firmware:-:*:*:*:*:*:*:* 1 OR
cpe:2.3:h:cypress:cyw89335l2cubgt:-:*:*:*:*:*:*:* 0 OR
AND
cpe:2.3:o:cypress:cyw89335lcubgt_firmware:-:*:*:*:*:*:*:* 1 OR
cpe:2.3:h:cypress:cyw89335lcubgt:-:*:*:*:*:*:*:* 0 OR
CVSS Version 2
  • Version
  • 2.0
  • Vector String
  • AV:A/AC:L/Au:N/C:P/I:P/A:P
  • Access Vector
  • ADJACENT_NETWORK
  • Access Compatibility
  • LOW
  • Authentication
  • NONE
  • Confidentiality Impact
  • PARTIAL
  • Integrity Impact
  • PARTIAL
  • Availability Impact
  • PARTIAL
  • Base Score
  • 5.8
  • Severity
  • MEDIUM
  • Exploitability Score
  • 6.5
  • Impact Score
  • 6.4
CVSS Version 3
  • Version
  • 3.0
  • Vector String
  • CVSS:3.0/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
  • Attack Vector
  • ADJACENT_NETWORK
  • Attack Compatibility
  • LOW
  • Privileges Required
  • NONE
  • User Interaction
  • NONE
  • Scope
  • UNCHANGED
  • Confidentiality Impact
  • HIGH
  • Availability Impact
  • HIGH
  • Base Score
  • 8.8
  • Base Severity
  • HIGH
  • Exploitability Score
  • 2.8
  • Impact Score
  • 5.9
References
Reference URL Reference Tags
https://www.broadcom.com/support/resources/product-security-center Vendor Advisory
https://source.android.com/security/bulletin/2019-05-01 Third Party Advisory
https://support.apple.com/kb/HT210348
http://seclists.org/fulldisclosure/2019/Jul/22
https://seclists.org/bugtraq/2019/Aug/21
http://seclists.org/fulldisclosure/2019/Aug/11
Sources
Source Name Source URL
NIST https://nvd.nist.gov/vuln/detail/CVE-2018-19860
MITRE https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-19860
History
Created Old Value New Value Data Type Notes
2022-05-10 16:30:48 Added to TrackCVE
2022-12-03 21:50:30 2019-06-07T17:29Z 2019-06-07T17:29:00 CVE Published Date updated
2022-12-03 21:50:30 2020-08-24T17:37:01 CVE Modified Date updated
2022-12-03 21:50:30 Modified Vulnerability Status updated
2022-12-29 13:08:48 Modified Undergoing Analysis Vulnerability Status updated
2022-12-29 15:08:20 Undergoing Analysis Modified Vulnerability Status updated