TI-2019-06937 Aliases CVE-2019-9501 GHSA-vjw8-c937-7hwp

Broadcom wl driver is vulnerable to heap buffer overflow

MEDIUM 44CWE-122Published 2020-02-03 · Updated 2024-08-04

Key facts

Attack vector: Adjacent network
Privileges required: None
User interaction: None
Attack complexity: Low
Impact type: Code execution
Confidentiality · integrity · availability: High · High · High
Fix status: Fixed

Attack profile from CVSS 3.1 · NVD. Fix status from CNA and Microsoft. Impact type from CWE-122 and the CVSS impact.

Summary

The Broadcom wl WiFi driver is vulnerable to a heap buffer overflow. By supplying a vendor information element with a data length larger than 32 bytes, a heap buffer overflow is triggered in wlc_wpa_sup_eapol. In the worst case scenario, by sending specially-crafted WiFi packets, a remote, unauthenticated attacker may be able to execute arbitrary code on a vulnerable system. More typically, this vulnerability will result in denial-of-service conditions.

Why it matters now

EPSS 0.03142 87th percentileScored 2026-11-07

Public exploit Yes 1 exploit referenceTagged by NVD

Fix Fixed Microsoft: 1 update

SSVC decision points

Not available: CISA has not published SSVC decision points for this record.

Affected products

Vendor	Product	Affected versions	Fixed in	Status	Source
Broadcom	WiFi drivers	wl	—	No fix listed	CNA

WiFi drivers VendorBroadcom Affected wl Fixed in — No fix listed CNA

CPE configurations NVD · 3

CPE	Versions	Role	Vendor
cpe:2.3:a:synology:router_manager:1.2:::::::*	1.2	Vulnerable	Synology
cpe:2.3:o:broadcom:bcm4339_firmware:-:::::::*	not specified by NVD	Vulnerable	Broadcom
cpe:2.3:h:broadcom:bcm4339:-:::::::*	not specified by NVD	Running on	Broadcom

cpe:2.3:a:synology:router_manager:1.2:*:*:*:*:*:*:* Versions 1.2 Vulnerable ·Synology
cpe:2.3:o:broadcom:bcm4339_firmware:-:*:*:*:*:*:*:* Versions not specified by NVD Vulnerable ·Broadcom
cpe:2.3:h:broadcom:bcm4339:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Broadcom

Remediation

Microsoft 1 update

ADV190017 Released 2019-06-11
Microsoft HoloLens Remote Code Execution Vulnerabilities

Timeline

2026-10-02 Threatist record created from CVE-2019-9501
2026-10-03 Alias added: GHSA-vjw8-c937-7hwp

References

Exploit 1

https://blog.quarkslab.com/reverse-engineering-broadcom-wireless-chipsets.html

Advisory 1

https://kb.cert.org/vuls/id/166939/

TI-2019-06938 Broadcom wl driver is vulnerable to heap buffer overflow CVSS 3.1HIGH 8.8

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences