CVE-2019-9503

The Broadcom brcmfmac WiFi driver prior to commit a4176ec356c73a46c07c181c6d04039fafa34a9f is vulnerable to a frame validation bypass. If the brcmfmac driver receives a firmware event frame from a remote source, the is_wlc_event_frame function will cause this frame to be discarded and unprocessed. If the driver receives the firmware event frame from the host, the appropriate handler is called. This frame validation can be bypassed if the bus used is USB (for instance by a wifi dongle). This can allow firmware event frames from a remote source to be processed. In the worst case scenario, by sending specially-crafted WiFi packets, a remote, unauthenticated attacker may be able to execute arbitrary code on a vulnerable system. More typically, this vulnerability will result in denial-of-service conditions.

• CWE-20
• CWE-20

• https://blog.quarkslab.com/reverse-engineering-broadcom-wireless-chipsets.htmlThird Party Advisory
• https://bugzilla.redhat.com/show_bug.cgi?id=1701842Issue Tracking, Third Party Advisory
• https://bugzilla.suse.com/show_bug.cgi?id=1132828Issue Tracking, Third Party Advisory
• https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?id=a4176ec356c73a46c07c181c6d04039fafa34a9fPatch, Third Party Advisory
• https://kb.cert.org/vuls/id/166939/Third Party Advisory, US Government Resource
• https://people.canonical.com/~ubuntu-security/cve/2019/CVE-2019-9503.htmlThird Party Advisory
• https://security-tracker.debian.org/tracker/CVE-2019-9503Third Party Advisory
• https://blog.quarkslab.com/reverse-engineering-broadcom-wireless-chipsets.htmlThird Party Advisory
• https://bugzilla.redhat.com/show_bug.cgi?id=1701842Issue Tracking, Third Party Advisory
• https://bugzilla.suse.com/show_bug.cgi?id=1132828Issue Tracking, Third Party Advisory
• https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?id=a4176ec356c73a46c07c181c6d04039fafa34a9fPatch, Third Party Advisory
• https://kb.cert.org/vuls/id/166939/Third Party Advisory, US Government Resource
• https://people.canonical.com/~ubuntu-security/cve/2019/CVE-2019-9503.htmlThird Party Advisory
• https://security-tracker.debian.org/tracker/CVE-2019-9503Third Party Advisory

Published

Jan 16, 2020

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2019-9497The implementations of EAP-PWD in hostapd EAP Server and wpa…
• CVE-2019-9498The implementations of EAP-PWD in hostapd EAP Server, when b…8.1
• CVE-2019-9499The implementations of EAP-PWD in wpa_supplicant EAP Peer, w…8.1
• CVE-2019-9500The Broadcom brcmfmac WiFi driver prior to commit 1b5e242316…8.3
• CVE-2019-9501The Broadcom wl WiFi driver is vulnerable to a heap buffer o…8.8
• CVE-2019-9502The Broadcom wl WiFi driver is vulnerable to a heap buffer o…8.8
• CVE-2019-9505The PrinterLogic Print Management software, versions up to a…9.8
• CVE-2019-9506The Bluetooth BR/EDR specification up to and including versi…8.1
• CVE-2019-9507The web interface of the Vertiv Avocent UMG-4000 version 4.2…7.2
• CVE-2019-9508The web interface of the Vertiv Avocent UMG-4000 version 4.2…3.5
• CVE-2019-9509The web interface of the Vertiv Avocent UMG-4000 version 4.2…5.4
• CVE-2019-9510A vulnerability in Microsoft Windows 10 1803 and Windows Ser…7.8