CVE-2019-6496
HIGHMarvell Avastar Wi-Fi Firmware - Remote Code Execution or Denial of Service via Malformed Wi-Fi Packets
Title source: llmDescription
The ThreadX-based firmware on Marvell Avastar Wi-Fi devices, models 88W8787, 88W8797, 88W8801, 88W8897, and 88W8997, allows remote attackers to execute arbitrary code or cause a denial of service (block pool overflow) via malformed Wi-Fi packets during identification of available Wi-Fi networks. Exploitation of the Wi-Fi device can lead to exploitation of the host application processor in some cases, but this depends on several factors including host OS hardening and the availability of DMA.
References (7)
Core 7
Core References
Third Party Advisory x_refsource_confirm
https://www.scribd.com/document/398350818/WiFi-CVE-2019-6496-Marvell-s-Statement
Third Party Advisory, VDB Entry vdb-entry
x_refsource_bid
http://www.securityfocus.com/bid/106865
Exploit, Third Party Advisory x_refsource_misc
https://2018.zeronights.ru/wp-content/uploads/materials/19-Researching-Marvell-Avastar-Wi-Fi.pdf
Third Party Advisory x_refsource_misc
https://embedi.org/blog/remotely-compromise-devices-by-using-bugs-in-marvell-avastar-wi-fi-from-zero-knowledge-to-zero-click-rce/
Exploit, Press/Media Coverage, Third Party Advisory x_refsource_misc
https://www.zdnet.com/article/wifi-firmware-bug-affects-laptops-smartphones-routers-gaming-devices/
Third Party Advisory x_refsource_confirm
https://www.synology.com/security/advisory/Synology_SA_19_07
Third Party Advisory, US Government Resource third-party-advisory
x_refsource_cert-vn
https://www.kb.cert.org/vuls/id/730261/
Scores
CVSS v3
8.8
EPSS
0.0662
EPSS Percentile
93.1%
Attack Vector
ADJACENT_NETWORK
CVSS:3.0/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Details
CWE
CWE-787
Status
published
Products (5)
marvell/88w8787_firmware
marvell/88w8797_firmware
marvell/88w8801_firmware
marvell/88w8897_firmware
marvell/88w8997_firmware
Published
Jan 20, 2019
Tracked Since
Feb 18, 2026