PT-2019-12876 · Espressif · Esp8266 Nonos Sdk+1

Publicado 2019-09-04 · Atualizado 2020-08-24 · CVE-2019-12587

Positive Technologies (AI Summary)

CVSS v3.1

8.1

Alta

Vetor base

AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N

Name of the Vulnerable Software and Affected Versions Espressif ESP-IDF versions 2.0.0 through 4.0.0 Espressif ESP8266 NONOS SDK versions 2.2.0 through 3.1.0

Description The issue concerns the EAP peer implementation, allowing the installation of a zero Pairwise Master Key (PMK) after completing any EAP authentication method. This enables attackers within radio range to replay, decrypt, or spoof frames via a rogue access point.

Recommendations For Espressif ESP-IDF versions 2.0.0 through 4.0.0, update to a version that addresses this issue. For Espressif ESP8266 NONOS SDK versions 2.2.0 through 3.1.0, update to a version that addresses this issue. As a temporary workaround, consider restricting access to sensitive data and implementing additional security measures to minimize the risk of exploitation via a rogue access point.

Exploit

Correção

Use of a Broken Cryptographic Algorithm

Enumeração de Fraquezas

CWE-327

Identificadores relacionados

CVE-2019-12587

Produtos afetados

Esp-Idf

Esp8266 Nonos Sdk

Referências · 7

• 🔥 https://github.com/Matheus-Garbelini/esp32_esp8266_attacks · Exploit
• https://matheus-garbelini.github.io/home/post/zero-pmk-installation · Correção
• https://t.me/github_repos/3385 · Publicação no Telegram
• https://nvd.nist.gov/vuln/detail/CVE-2019-12587 · Nota de Segurança
• https://github.com/espressif · Nota
• https://osv.dev/vulnerability/CVE-2019-12587 · Aviso do Fabricante
• https://t.me/cybersecuritytechnologies/429 · Publicação no Telegram