CVE-2019-3405

In the 3.1.3.64296 and lower version of 360F5, the third party can trigger the device to send a deauth frame by constructing and sending a specific illegal 802.11 Null Data Frame, which will cause other wireless terminals connected to disconnect from the wireless, so as to attack the router wireless by DoS. At present, the vulnerability has been effectively handled, and users can fix the vulnerability after updating the firmware version.

CVSS v3 5.3 MEDIUM
CVSS v2.0 5.0 MEDIUM

5.3^/10

CVSS v3 : MEDIUM

Vector :

Exploitability : 3.9 / Impact : 1.4

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required NONE

User Interaction NONE

Confidentiality Impact NONE

Integrity Impact NONE

Availability Impact LOW

Scope UNCHANGED

5.0^/10

CVSS v2.0 : MEDIUM

Vector : AV:N/AC:L/Au:N/C:N/I:N/A:P

Exploitability : 10.0 / Impact : 2.9

Access Vector NETWORK

Access Complexity LOW

Authentication NONE

Confidentiality Impact NONE

Integrity Impact NONE

Availability Impact PARTIAL

References

Link	Resource
https://security.360.cn/News/news/id/246	Vendor Advisory
https://security.360.cn/News/news/id/246	Vendor Advisory

Configurations

Configuration 1 (hide)

AND

cpe:2.3:o:360:360f5_firmware:*:*:*:*:*:*:*:*

cpe:2.3:h:360:360f5:-:*:*:*:*:*:*:*

History

21 Nov 2024, 04:42

Type	Values Removed	Values Added
References	~~() https://security.360.cn/News/news/id/246 - Vendor Advisory~~	() https://security.360.cn/News/news/id/246 - Vendor Advisory

Information

Published : 2021-01-11 16:15

Updated : 2024-11-21 04:42

NVD link : CVE-2019-3405

Mitre link : CVE-2019-3405

CVE.ORG link : CVE-2019-3405

JSON object : View

Products Affected

360

360f5_firmware
360f5

CWE

NVD-CWE-noinfo

{"id": "CVE-2019-3405", "metrics": {"cvssMetricV2": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"version": "2.0", "baseScore": 5.0, "accessVector": "NETWORK", "vectorString": "AV:N/AC:L/Au:N/C:N/I:N/A:P", "authentication": "NONE", "integrityImpact": "NONE", "accessComplexity": "LOW", "availabilityImpact": "PARTIAL", "confidentialityImpact": "NONE"}, "acInsufInfo": false, "impactScore": 2.9, "baseSeverity": "MEDIUM", "obtainAllPrivilege": false, "exploitabilityScore": 10.0, "obtainUserPrivilege": false, "obtainOtherPrivilege": false, "userInteractionRequired": false}], "cvssMetricV31": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 5.3, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "LOW", "privilegesRequired": "NONE", "confidentialityImpact": "NONE"}, "impactScore": 1.4, "exploitabilityScore": 3.9}]}, "published": "2021-01-11T16:15:14.350", "references": [{"url": "https://security.360.cn/News/news/id/246", "tags": ["Vendor Advisory"], "source": "security@360.cn"}, {"url": "https://security.360.cn/News/news/id/246", "tags": ["Vendor Advisory"], "source": "af854a3a-2127-422b-91ae-364da2661108"}], "vulnStatus": "Modified", "weaknesses": [{"type": "Primary", "source": "nvd@nist.gov", "description": [{"lang": "en", "value": "NVD-CWE-noinfo"}]}], "descriptions": [{"lang": "en", "value": "In the 3.1.3.64296 and lower version of 360F5, the third party can trigger the device to send a deauth frame by constructing and sending a specific illegal 802.11 Null Data Frame, which will cause other wireless terminals connected to disconnect from the wireless, so as to attack the router wireless by DoS. At present, the vulnerability has been effectively handled, and users can fix the vulnerability after updating the firmware version."}, {"lang": "es", "value": "En la versi\u00f3n 3.1.3.64296 y versi\u00f3n inferior de 360F5, los terceros pueden activar el dispositivo para enviar una trama de autenticaci\u00f3n mediante la construcci\u00f3n y el env\u00edo de un 802.11 Null Data Frame ilegal espec\u00edfico, lo que causar\u00e1 que otros terminales inal\u00e1mbricos conectados se desconecten de la red inal\u00e1mbrica, que es atacar el enrutador inal\u00e1mbrico mediante una DoS. En la actualidad, la vulnerabilidad se ha manejado de manera eficaz y los usuarios pueden corregirla despu\u00e9s de actualizar la versi\u00f3n del firmware"}], "lastModified": "2024-11-21T04:42:02.567", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:o:360:360f5_firmware:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "D523167D-CA4B-45D9-A6A5-93107E0182DF", "versionEndIncluding": "3.1.3.64296"}], "operator": "OR"}, {"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:h:360:360f5:-:*:*:*:*:*:*:*", "vulnerable": false, "matchCriteriaId": "35BE7932-8FB6-4FF8-9E09-AF31F3616C98"}], "operator": "OR"}], "operator": "AND"}], "sourceIdentifier": "security@360.cn"}