What is the CVSS score of CVE-2019-9659?

CVE-2019-9659 has a CVSS 3.0 base score of 9.1 (Critical). CVSS vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H. EPSS exploitation probability: 1.3%.

Wifi Alarm System Firmware CVE-2019-9659

CRITICAL

Authentication Bypass by Capture-replay (CWE-294)

2019-03-11 cve@mitre.org

Information Disclosure Wifi Alarm System Firmware Wifi Cellular Smart Home System H4 Plus Firmware Awv Plus Wifi Alarm System Firmware G5W 3G Firmware G5 Plus Gsm Sms Rfid Touch Alarm System Firmware G3 Gsm Sms Alarm System Firmware B11 Dual Network Alarm System Firmware A8 Pstn Alarm System Firmware A11 Pstn Lcd Rfid Touch Alarm System Firmware Cg 105S On Site Alarm System Firmware Em8617 Ov2 Wifi Alarm System Firmware

9.1

CVSS 3.0 · NVD

Severity by source

NVD PRIMARY

9.1 CRITICAL

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

None

Integrity

High

Availability

High

Lifecycle Timeline

CVE Published

Mar 11, 2019 - 15:29 nvd

CRITICAL 9.1

DescriptionNVD

The Chuango 433 MHz burglar-alarm product line uses static codes in the RF remote control, allowing an attacker to arm, disarm, or trigger the alarm remotely via replay attacks, as demonstrated by Chuango branded products, and non-Chuango branded products such as the Eminent EM8617 OV2 Wifi Alarm System.

AnalysisAI

The Chuango 433 MHz burglar-alarm product line uses static codes in the RF remote control, allowing an attacker to arm, disarm, or trigger the alarm remotely via replay attacks, as demonstrated by. Rated critical severity (CVSS 9.1), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.

Technical ContextAI

This vulnerability is classified under CWE-294. The Chuango 433 MHz burglar-alarm product line uses static codes in the RF remote control, allowing an attacker to arm, disarm, or trigger the alarm remotely via replay attacks, as demonstrated by Chuango branded products, and non-Chuango branded products such as the Eminent EM8617 OV2 Wifi Alarm System. Affected products include: Chuango Wifi Alarm System Firmware, Chuango Wifi\/Cellular Smart Home System H4 Plus Firmware, Chuango Awv Plus Wifi Alarm System Firmware, Chuango G5W 3G Firmware, Chuango G5 Plus Gsm\/Sms\/Rfid Touch Alarm System Firmware.

RemediationAI

No vendor patch is available at time of analysis. Monitor vendor advisories for updates. Apply vendor patches when available. Implement network segmentation and monitoring as interim mitigations.