Read the docs
TI-2019-09400 Aliases CVE-2019-12588GHSA-w5cj-7hxw-2355

The client 802.11 mac implementation in Espressif ESP8266_NONOS_SDK 2.2.0 through 3.1.0…

Priority LOW 31CWE-20Published · Updated

Key facts

Attack vector
Adjacent network
Privileges required
None
User interaction
None
Attack complexity
Low
Impact type
—
Confidentiality · integrity · availability
None · None · High
Fix status
No fix listed

Attack profile from CVSS 3.1 · NVD. Fix status from CNA.

Summary

The client 802.11 mac implementation in Espressif ESP8266_NONOS_SDK 2.2.0 through 3.1.0 does not validate correctly the RSN AuthKey suite list count in beacon frames, probe responses, and association responses, which allows attackers in radio range to cause a denial of service (crash) via a crafted message.

Why it matters now

EPSS 0.01296 70th percentileScored 2026-11-07
Public exploit Yes 2 exploit referencesTagged by NVD
Fix No fix listed No fixed version in the sources yet

SSVC decision points

Not available: CISA has not published SSVC decision points for this record.

Affected products

VendorProductAffected versionsFixed inStatusSource
——all versions—No fix listedCNA
  • — Vendor— Affected all versions Fixed in — No fix listed CNA

CPE configurations NVD · 2

CPEVersionsRoleVendor
cpe:2.3:a:espressif:arduino_esp8266:*:*:*:*:*:*:*:*up to 2.5.2Vulnerableespressif
cpe:2.3:a:espressif:esp8266_nonos_sdk:*:*:*:*:*:*:*:*2.2.0 – 3.1.0Vulnerableespressif
  • cpe:2.3:a:espressif:arduino_esp8266:*:*:*:*:*:*:*:* Versions up to 2.5.2 Vulnerable ·espressif
  • cpe:2.3:a:espressif:esp8266_nonos_sdk:*:*:*:*:*:*:*:* Versions 2.2.0 – 3.1.0 Vulnerable ·espressif

Remediation

No fixed version listed by the sources yet.

Timeline

  1. 2026-10-02 Threatist record created from CVE-2019-12588
  2. 2026-10-03 Alias added: GHSA-w5cj-7hxw-2355

References

Exploit 2

Other 1

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences