3.1

CVE-2019-15126: apple ipados

Modified
AliasesMGASA-2021-0103MGASA-2021-0104SUSE-SU-2021:4003-1
Published 05-02-2020Last modified 05-08-2024

Vulnerability summary

CVE-2019-15126 is a low (CVSS 3.1) vulnerability in apple ipados. EPSS estimates a 7.26% chance of exploitation in the next 30 days, higher than 94.3% of scored vulnerabilities. 1 public exploit is recorded.

Priority
Routine

Not severe (CVSS 3.1, adjacent network); no exploitation reported by the 5 checked sources

Source freshness unavailable

How is this decided?
CVSS score
3.1/10
010
Low · v3.1 (NVD)
EPSS score
7.26%
0%100%
Low · 0.00 pp in 30 days
KEVNot listedNot listed by any tracked catalog.
RansomwareNot flaggedNo ransomware use recorded.
Public exploits1exploit-database

Advisory lineage

Upstream 0 · Downstream 7 · Related 7
OPENSUSE-SU-2022:0366-1SUSE-SU-2022:0068-1SUSE-SU-2022:0080-1SUSE-SU-2022:0090-1SUSE-SU-2022:0366-1SUSE-SU-2022:0367-1

Timeline

  1. 05-02-2020
    PublishedVulnerability first disclosed.
  2. 05-08-2024
    Last modifiedVulnerability information updated.

Description

An issue was discovered on Broadcom Wi-Fi client devices. Specifically timed and handcrafted traffic can cause internal errors (related to state transitions) in a WLAN device that lead to improper layer 2 Wi-Fi encryption with a consequent possibility of information disclosure over the air for a discrete set of traffic, a different vulnerability than CVE-2019-9500, CVE-2019-9501, CVE-2019-9502, and CVE-2019-9503.

CVSS metrics

2 scores · 1 source · 2 versions

EPSS trend

Probability

7.26%

Chance of exploitation in the next 30 days

Percentile

94%

Versus all other CVEs

30-day change

No change 0.00 pp

From 7.26% on 04-10-2026

04-10-202603-11-2026

Known exploited

Compare KEV catalogs
CISA KEV

Not in the CISA KEV catalog.

ENISA CNW

Not in the ENISA CNW catalog.

CIRCL

Not in the CIRCL catalog.

Public exploits

1 found
  • exploit-databaseremotemultipleUnverified

    Broadcom Wi-Fi Devices - 'KR00K Information Disclosure

    Maturity: poc

Weaknesses

CWE · root cause

Affected systems

Version check

Known conditions: adjacent network, no authentication, no user interaction (CVSS vector). Other conditions: not stated in public data.

Suse7 products
  • bcm43xx-firmware&distro=SUSE Linux Enterprise Server 12 SP4-LTSS< 20180314-4.6.1
  • bcm43xx-firmware&distro=SUSE Linux Enterprise Server 12 SP5< 20180314-4.6.1
  • bcm43xx-firmware&distro=SUSE Linux Enterprise Server for SAP Applications 12 SP5< 20180314-4.6.1
  • kernel-firmware&distro=SUSE Linux Enterprise Micro 5.0< 20200107-3.23.1
  • kernel-firmware&distro=SUSE Linux Enterprise Module for Basesystem 15 SP2< 20200107-3.23.1
Broadcom6 products
Apple3 products
Mageia3 products
  • kernel-firmware-nonfree< 20210223-1.mga7.nonfree
  • radeon-firmware< 20210211-1.mga7.nonfree
  • kernel-firmware-nonfree< 20210223-1.mga8.nonfree
Opensuse1 product
  • kernel-firmware&distro=openSUSE Leap 15.2< 20200107-lp152.2.9.1

5 vendors · 20 products

References

23 links
Show all 23 references