CVE-2019-18659
Last modified
CVE-2019-18659 is a medium-severity vulnerability rated 5.3/10 on the CVSS scale. The Wireless Emergency Alerts (WEA) protocol allows remote attackers to spoof a Presidential Alert because cryptographic authentication is not used, as demonstrated by MessageIdentifier 4370 in LTE System Information Block 12 (aka SIB12). NOTE: testing inside an RF-isolated shield box suggested that all LTE phones are affected by design (e.g., use of Android versus iOS does not matter); testing in an open RF environment is, of course, contraindicated.. EPSS estimates a 0.98% chance of exploitation in the next 30 days.
Description
The Wireless Emergency Alerts (WEA) protocol allows remote attackers to spoof a Presidential Alert because cryptographic authentication is not used, as demonstrated by MessageIdentifier 4370 in LTE System Information Block 12 (aka SIB12). NOTE: testing inside an RF-isolated shield box suggested that all LTE phones are affected by design (e.g., use of Android versus iOS does not matter); testing in an open RF environment is, of course, contraindicated.
Metrics
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N
Weakness Enumeration
Affected Software
| Vendor | Product | Versions |
|---|---|---|
| Ready | Wireless Emergency Alerts | All versions |
References
- https://dl.acm.org/citation.cfm?id=3326082Third Party Advisory
- https://dl.acm.org/citation.cfm?id=3326082Third Party Advisory
Timeline
- Published
- Last Modified
- Status
- Modified
Frequently Asked Questions
What is CVE-2019-18659?
How severe is CVE-2019-18659?
How do I fix CVE-2019-18659?
How Strix Helps
- Same Subject, Wrong User: A Cross-Issuer Account Takeover in n8nStrix found an identity-binding bug in n8n's token-exchange flow enabling account takeover.
- Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
- PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
- AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.
Related CVEs from 2019
- CVE-2019-18653A Cross Site Scripting (XSS) issue exists in Avast AntiVirus…6.1
- CVE-2019-18654A Cross Site Scripting (XSS) issue exists in AVG AntiVirus (…6.1
- CVE-2019-18655File Sharing Wizard version 1.5.0 build 2008 is affected by …9.8
- CVE-2019-18656Pimcore 6.2.3 has XSS in the translations grid because bundl…6.1
- CVE-2019-18657ClickHouse before 19.13.5.44 allows HTTP header injection vi…5.3
- CVE-2019-18658In Helm 2.x before 2.15.2, commands that deal with loading a…9.8
- CVE-2019-1866Cisco Webex Business Suite before 39.1.0 contains a vulnerab…3.7
- CVE-2019-18660The Linux kernel before 5.4.1 on powerpc allows Information …4.7
- CVE-2019-18661Fastweb FASTGate 1.0.1b devices allow partial authentication…7.5
- CVE-2019-18662An issue was discovered in YouPHPTube through 7.7. User inpu…9.8
- CVE-2019-18663A SQL injection vulnerability in a /login/forgot1 POST reque…9.8
- CVE-2019-18664The Log module in SECUDOS DOMOS before 5.6 allows XSS.5.4
Are you affected by CVE-2019-18659?
Run a free Strix scan to check your systems for this vulnerability.
Scan your code nowSource: NVD / NIST