PT-2019-12875 · Espressif · Esp8266 Nonos Sdk+1

CVE-2019-12586 · Publicado 2019-09-04 · Atualizado 2025-12-12

Positive Technologies (AI Summary)

CVSS v3.1

6.5

Média

Vetor base

AV:A/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Name of the Vulnerable Software and Affected Versions Espressif ESP-IDF versions 2.0.0 through 4.0.0 Espressif ESP8266 NONOS SDK versions 2.2.0 through 3.1.0

Description The issue concerns the EAP peer implementation, which processes EAP Success messages prematurely. This allows attackers within radio range to craft a message that can cause a denial of service, leading to a crash.

Recommendations For Espressif ESP-IDF versions 2.0.0 through 4.0.0, update to a version outside of this range to resolve the issue. For Espressif ESP8266 NONOS SDK versions 2.2.0 through 3.1.0, update to a version outside of this range to resolve the issue. As a temporary workaround, consider restricting access to EAP Success messages until a patch is available.

Exploit

Correção

Identificadores relacionados

CVE-2019-12586

Produtos afetados

Esp-Idf

Esp8266 Nonos Sdk

Referências · 8

• 🔥 https://github.com/Matheus-Garbelini/esp32_esp8266_attacks · Exploit
• 🔥 https://matheus-garbelini.github.io/home/post/esp32-esp8266-eap-crash · Exploit
• https://t.me/github_repos/3385 · Publicação no Telegram
• https://github.com/espressif · Nota
• https://twitter.com/grok/status/1999608703641698683 · Publicação no Twitter
• https://nvd.nist.gov/vuln/detail/CVE-2019-12586 · Nota de Segurança
• https://osv.dev/vulnerability/CVE-2019-12586 · Aviso do Fabricante
• https://t.me/cybersecuritytechnologies/429 · Publicação no Telegram