CVE-2019-3405 (GCVE-0-2019-3405)

Vulnerability from cvelistv5 – Published: 2021-01-11 15:48 – Updated: 2024-08-04 19:12
VLAI?
Summary
In the 3.1.3.64296 and lower version of 360F5, the third party can trigger the device to send a deauth frame by constructing and sending a specific illegal 802.11 Null Data Frame, which will cause other wireless terminals connected to disconnect from the wireless, so as to attack the router wireless by DoS. At present, the vulnerability has been effectively handled, and users can fix the vulnerability after updating the firmware version.
Severity ?
No CVSS data available.
CWE
  • DOS
Assigner
References
Impacted products
Vendor Product Version
n/a 360F5 Affected: 3.1.3.64296 and lower version.
Show details on NVD website
To clipboard 

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-04T19:12:08.565Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "tags": [
              "x_refsource_MISC",
              "x_transferred"
            ],
            "url": "https://security.360.cn/News/news/id/246"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "360F5",
          "vendor": "n/a",
          "versions": [
            {
              "status": "affected",
              "version": "3.1.3.64296 and lower version."
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the 3.1.3.64296 and lower version of 360F5, the third party can trigger the device to send a deauth frame by constructing and sending a specific illegal 802.11 Null Data Frame, which will cause other wireless terminals connected to disconnect from the wireless, so as to attack the router wireless by DoS. At present, the vulnerability has been effectively handled, and users can fix the vulnerability after updating the firmware version."
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "description": "DOS",
              "lang": "en",
              "type": "text"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2021-01-11T15:48:41",
        "orgId": "40f8fa2f-7875-43d0-a30e-e901a5537754",
        "shortName": "360ST"
      },
      "references": [
        {
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://security.360.cn/News/news/id/246"
        }
      ],
      "x_legacyV4Record": {
        "CVE_data_meta": {
          "ASSIGNER": "security@360.cn",
          "ID": "CVE-2019-3405",
          "STATE": "PUBLIC"
        },
        "affects": {
          "vendor": {
            "vendor_data": [
              {
                "product": {
                  "product_data": [
                    {
                      "product_name": "360F5",
                      "version": {
                        "version_data": [
                          {
                            "version_value": "3.1.3.64296 and lower version."
                          }
                        ]
                      }
                    }
                  ]
                },
                "vendor_name": "n/a"
              }
            ]
          }
        },
        "data_format": "MITRE",
        "data_type": "CVE",
        "data_version": "4.0",
        "description": {
          "description_data": [
            {
              "lang": "eng",
              "value": "In the 3.1.3.64296 and lower version of 360F5, the third party can trigger the device to send a deauth frame by constructing and sending a specific illegal 802.11 Null Data Frame, which will cause other wireless terminals connected to disconnect from the wireless, so as to attack the router wireless by DoS. At present, the vulnerability has been effectively handled, and users can fix the vulnerability after updating the firmware version."
            }
          ]
        },
        "problemtype": {
          "problemtype_data": [
            {
              "description": [
                {
                  "lang": "eng",
                  "value": "DOS"
                }
              ]
            }
          ]
        },
        "references": {
          "reference_data": [
            {
              "name": "https://security.360.cn/News/news/id/246",
              "refsource": "MISC",
              "url": "https://security.360.cn/News/news/id/246"
            }
          ]
        }
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "40f8fa2f-7875-43d0-a30e-e901a5537754",
    "assignerShortName": "360ST",
    "cveId": "CVE-2019-3405",
    "datePublished": "2021-01-11T15:48:42",
    "dateReserved": "2018-12-19T00:00:00",
    "dateUpdated": "2024-08-04T19:12:08.565Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1",
  "vulnerability-lookup:meta": {
    "fkie_nvd": {
      "configurations": "[{\"operator\": \"AND\", \"nodes\": [{\"operator\": \"OR\", \"negate\": false, \"cpeMatch\": [{\"vulnerable\": true, \"criteria\": \"cpe:2.3:o:360:360f5_firmware:*:*:*:*:*:*:*:*\", \"versionEndIncluding\": \"3.1.3.64296\", \"matchCriteriaId\": \"D523167D-CA4B-45D9-A6A5-93107E0182DF\"}]}, {\"operator\": \"OR\", \"negate\": false, \"cpeMatch\": [{\"vulnerable\": false, \"criteria\": \"cpe:2.3:h:360:360f5:-:*:*:*:*:*:*:*\", \"matchCriteriaId\": \"35BE7932-8FB6-4FF8-9E09-AF31F3616C98\"}]}]}]",
      "descriptions": "[{\"lang\": \"en\", \"value\": \"In the 3.1.3.64296 and lower version of 360F5, the third party can trigger the device to send a deauth frame by constructing and sending a specific illegal 802.11 Null Data Frame, which will cause other wireless terminals connected to disconnect from the wireless, so as to attack the router wireless by DoS. At present, the vulnerability has been effectively handled, and users can fix the vulnerability after updating the firmware version.\"}, {\"lang\": \"es\", \"value\": \"En la versi\\u00f3n 3.1.3.64296 y versi\\u00f3n inferior de 360F5, los terceros pueden activar el dispositivo para enviar una trama de autenticaci\\u00f3n mediante la construcci\\u00f3n y el env\\u00edo de un 802.11 Null Data Frame ilegal espec\\u00edfico, lo que causar\\u00e1 que otros terminales inal\\u00e1mbricos conectados se desconecten de la red inal\\u00e1mbrica, que es atacar el enrutador inal\\u00e1mbrico mediante una DoS.\u0026#xa0;En la actualidad, la vulnerabilidad se ha manejado de manera eficaz y los usuarios pueden corregirla despu\\u00e9s de actualizar la versi\\u00f3n del firmware\"}]",
      "id": "CVE-2019-3405",
      "lastModified": "2024-11-21T04:42:02.567",
      "metrics": "{\"cvssMetricV31\": [{\"source\": \"nvd@nist.gov\", \"type\": \"Primary\", \"cvssData\": {\"version\": \"3.1\", \"vectorString\": \"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L\", \"baseScore\": 5.3, \"baseSeverity\": \"MEDIUM\", \"attackVector\": \"NETWORK\", \"attackComplexity\": \"LOW\", \"privilegesRequired\": \"NONE\", \"userInteraction\": \"NONE\", \"scope\": \"UNCHANGED\", \"confidentialityImpact\": \"NONE\", \"integrityImpact\": \"NONE\", \"availabilityImpact\": \"LOW\"}, \"exploitabilityScore\": 3.9, \"impactScore\": 1.4}], \"cvssMetricV2\": [{\"source\": \"nvd@nist.gov\", \"type\": \"Primary\", \"cvssData\": {\"version\": \"2.0\", \"vectorString\": \"AV:N/AC:L/Au:N/C:N/I:N/A:P\", \"baseScore\": 5.0, \"accessVector\": \"NETWORK\", \"accessComplexity\": \"LOW\", \"authentication\": \"NONE\", \"confidentialityImpact\": \"NONE\", \"integrityImpact\": \"NONE\", \"availabilityImpact\": \"PARTIAL\"}, \"baseSeverity\": \"MEDIUM\", \"exploitabilityScore\": 10.0, \"impactScore\": 2.9, \"acInsufInfo\": false, \"obtainAllPrivilege\": false, \"obtainUserPrivilege\": false, \"obtainOtherPrivilege\": false, \"userInteractionRequired\": false}]}",
      "published": "2021-01-11T16:15:14.350",
      "references": "[{\"url\": \"https://security.360.cn/News/news/id/246\", \"source\": \"security@360.cn\", \"tags\": [\"Vendor Advisory\"]}, {\"url\": \"https://security.360.cn/News/news/id/246\", \"source\": \"af854a3a-2127-422b-91ae-364da2661108\", \"tags\": [\"Vendor Advisory\"]}]",
      "sourceIdentifier": "security@360.cn",
      "vulnStatus": "Modified",
      "weaknesses": "[{\"source\": \"nvd@nist.gov\", \"type\": \"Primary\", \"description\": [{\"lang\": \"en\", \"value\": \"NVD-CWE-noinfo\"}]}]"
    },
    "nvd": "{\"cve\":{\"id\":\"CVE-2019-3405\",\"sourceIdentifier\":\"security@360.cn\",\"published\":\"2021-01-11T16:15:14.350\",\"lastModified\":\"2024-11-21T04:42:02.567\",\"vulnStatus\":\"Modified\",\"cveTags\":[],\"descriptions\":[{\"lang\":\"en\",\"value\":\"In the 3.1.3.64296 and lower version of 360F5, the third party can trigger the device to send a deauth frame by constructing and sending a specific illegal 802.11 Null Data Frame, which will cause other wireless terminals connected to disconnect from the wireless, so as to attack the router wireless by DoS. At present, the vulnerability has been effectively handled, and users can fix the vulnerability after updating the firmware version.\"},{\"lang\":\"es\",\"value\":\"En la versi\u00f3n 3.1.3.64296 y versi\u00f3n inferior de 360F5, los terceros pueden activar el dispositivo para enviar una trama de autenticaci\u00f3n mediante la construcci\u00f3n y el env\u00edo de un 802.11 Null Data Frame ilegal espec\u00edfico, lo que causar\u00e1 que otros terminales inal\u00e1mbricos conectados se desconecten de la red inal\u00e1mbrica, que es atacar el enrutador inal\u00e1mbrico mediante una DoS.\u0026#xa0;En la actualidad, la vulnerabilidad se ha manejado de manera eficaz y los usuarios pueden corregirla despu\u00e9s de actualizar la versi\u00f3n del firmware\"}],\"metrics\":{\"cvssMetricV31\":[{\"source\":\"nvd@nist.gov\",\"type\":\"Primary\",\"cvssData\":{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L\",\"baseScore\":5.3,\"baseSeverity\":\"MEDIUM\",\"attackVector\":\"NETWORK\",\"attackComplexity\":\"LOW\",\"privilegesRequired\":\"NONE\",\"userInteraction\":\"NONE\",\"scope\":\"UNCHANGED\",\"confidentialityImpact\":\"NONE\",\"integrityImpact\":\"NONE\",\"availabilityImpact\":\"LOW\"},\"exploitabilityScore\":3.9,\"impactScore\":1.4}],\"cvssMetricV2\":[{\"source\":\"nvd@nist.gov\",\"type\":\"Primary\",\"cvssData\":{\"version\":\"2.0\",\"vectorString\":\"AV:N/AC:L/Au:N/C:N/I:N/A:P\",\"baseScore\":5.0,\"accessVector\":\"NETWORK\",\"accessComplexity\":\"LOW\",\"authentication\":\"NONE\",\"confidentialityImpact\":\"NONE\",\"integrityImpact\":\"NONE\",\"availabilityImpact\":\"PARTIAL\"},\"baseSeverity\":\"MEDIUM\",\"exploitabilityScore\":10.0,\"impactScore\":2.9,\"acInsufInfo\":false,\"obtainAllPrivilege\":false,\"obtainUserPrivilege\":false,\"obtainOtherPrivilege\":false,\"userInteractionRequired\":false}]},\"weaknesses\":[{\"source\":\"nvd@nist.gov\",\"type\":\"Primary\",\"description\":[{\"lang\":\"en\",\"value\":\"NVD-CWE-noinfo\"}]}],\"configurations\":[{\"operator\":\"AND\",\"nodes\":[{\"operator\":\"OR\",\"negate\":false,\"cpeMatch\":[{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:360:360f5_firmware:*:*:*:*:*:*:*:*\",\"versionEndIncluding\":\"3.1.3.64296\",\"matchCriteriaId\":\"D523167D-CA4B-45D9-A6A5-93107E0182DF\"}]},{\"operator\":\"OR\",\"negate\":false,\"cpeMatch\":[{\"vulnerable\":false,\"criteria\":\"cpe:2.3:h:360:360f5:-:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"35BE7932-8FB6-4FF8-9E09-AF31F3616C98\"}]}]}],\"references\":[{\"url\":\"https://security.360.cn/News/news/id/246\",\"source\":\"security@360.cn\",\"tags\":[\"Vendor Advisory\"]},{\"url\":\"https://security.360.cn/News/news/id/246\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\",\"tags\":[\"Vendor Advisory\"]}]}}"
  }
}


Log in or create an account to share your comment.




Tags
Taxonomy of the tags.




Sightings

Author Source Type Date

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.



Detection rules are retrieved from Rulezet.