What is CVE-2019-17520?

CVE-2019-17520 is a medium-severity vulnerability in Ti Cc2640r2, classified under Buffer Copy without Checking Size of Input (Classic Buffer Overflow). CVSS score: 6.5/10. Published 2020-02-10.

How severe is CVE-2019-17520?

Medium severity. CVSS v3 base score is 6.5 out of 10.

Is CVE-2019-17520 known to be exploited?

5 public proof-of-concept repositories are indexed. Not currently listed in the CISA KEV catalog.

Buffer overflow in Ti Cc2640r2

CVE-2019-17520

The Bluetooth Low Energy implementation on Texas Instruments SDK through 3.30.00.20 for CC2640R2 devices does not properly restrict the SM Public Key packet on reception, allowing attackers in radio range to cause a denial of service (crash) via crafted packets.

Vulnerability class: Buffer Overflow

EPSS: 0.018 (76.4th percentile) — read the EPSS interpretation.

CVSS v3 metric

CVSS v3 base score 6.5 (Medium). Vector: CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H.

Affected products

Weakness classification (CWE)

CWE-120 — Buffer Copy without Checking Size of Input (Classic Buffer Overflow)

Public proof-of-concept exploits

References

cve@mitre.org (Product, x_refsource_MISC, Vendor Advisory)
cve@mitre.org (Third Party Advisory, x_refsource_MISC)
cve@mitre.org (Exploit, Third Party Advisory, x_refsource_MISC)

Frequently asked questions

What is CVE-2019-17520?: CVE-2019-17520 is a medium-severity vulnerability in Ti Cc2640r2, classified under Buffer Copy without Checking Size of Input (Classic Buffer Overflow). CVSS score: 6.5/10. Published 2020-02-10.
How severe is CVE-2019-17520?: Medium severity. CVSS v3 base score is 6.5 out of 10.
Is CVE-2019-17520 known to be exploited?: 5 public proof-of-concept repositories are indexed. Not currently listed in the CISA KEV catalog.