1. Home
  2. CVE Database
  3. CVE-2019-17519
HIGH · 8.8

CVE-2019-17519

The Bluetooth Low Energy implementation on NXP SDK through 2.2.1 for KW41Z devices does not properly restrict the Link Layer payload length, allowing attackers in radio range to cause a buffer overflo...

Vulnerability Description

The Bluetooth Low Energy implementation on NXP SDK through 2.2.1 for KW41Z devices does not properly restrict the Link Layer payload length, allowing attackers in radio range to cause a buffer overflow via a crafted packet.

CVSS Score

8.8

HIGH

CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Attack Vector
ADJACENT_NETWORK
Attack Complexity
LOW
Privileges Required
NONE
User Interaction
NONE
Scope
UNCHANGED
Confidentiality
HIGH
Integrity
HIGH
Availability
HIGH

Affected Products

VendorProductVersions
NxpMcuxpresso Software Development Kit<= 2.2.1
NxpKw31Z-
NxpKw34-
NxpKw35-
NxpKw36-
NxpKw37-
NxpKw38-
NxpKw39-
NxpKw41Z-

Related Weaknesses (CWE)

CWE-120

References

FAQ

What is CVE-2019-17519?

CVE-2019-17519 is a vulnerability with a CVSS score of 8.8 (HIGH). The Bluetooth Low Energy implementation on NXP SDK through 2.2.1 for KW41Z devices does not properly restrict the Link Layer payload length, allowing attackers in radio range to cause a buffer overflo...

How severe is CVE-2019-17519?

CVE-2019-17519 has been rated HIGH with a CVSS base score of 8.8/10. Review the CVSS metrics above for detailed severity breakdown.

Is there a patch for CVE-2019-17519?

Check the references section above for vendor advisories and patch information. Affected products include: Nxp Mcuxpresso Software Development Kit, Nxp Kw31Z, Nxp Kw34, Nxp Kw35, Nxp Kw36.