CVE-2019-17520: ti cc2640r2_software_development_kit Classic Buffer Overflow

Vulnerability summary

CVE-2019-17520 is a medium (CVSS 6.5) Classic Buffer Overflow vulnerability in ti cc2640r2_software_development_kit. EPSS estimates a 1.81% chance of exploitation in the next 30 days, higher than 78.3% of scored vulnerabilities. 1 public exploit is recorded.

Timeline

1. 10-02-2020
   PublishedVulnerability first disclosed.
2. 05-08-2024
   Last modifiedVulnerability information updated.

Description

The Bluetooth Low Energy implementation on Texas Instruments SDK through 3.30.00.20 for CC2640R2 devices does not properly restrict the SM Public Key packet on reception, allowing attackers in radio range to cause a denial of service (crash) via crafted packets.

• CWE-120Buffer Copy without Checking Size of Input ('Classic Buffer Overflow')The product copies an input buffer to an output buffer without verifying that the size of the input buffer is less than the size of the output buffer.