Vulnerability Details : CVE-2020-28349
An inaccurate frame deduplication process in ChirpStack Network Server 3.9.0 allows a malicious gateway to perform uplink Denial of Service via malformed frequency attributes in CollectAndCallOnceCollect in internal/uplink/collect.go. NOTE: the vendor's position is that there are no "guarantees that allowing untrusted LoRa gateways to the network should still result in a secure network.
Vulnerability category: Denial of service
Products affected by CVE-2020-28349
- cpe:2.3:a:chirpstack:network_server:3.9.0:*:*:*:*:*:*:*
Exploit prediction scoring system (EPSS) score for CVE-2020-28349
0.18%
Probability of exploitation activity in the next 30 days
EPSS Score History
~ 55 %
Percentile, the proportion of vulnerabilities that are scored at or less
CVSS scores for CVE-2020-28349
| Base Score | Base Severity | CVSS Vector | Exploitability Score | Impact Score | Score Source | First Seen |
|---|---|---|---|---|---|---|
|
6.8
|
MEDIUM | AV:N/AC:L/Au:S/C:N/I:N/A:C |
8.0
|
6.9
|
NIST | |
|
6.5
|
MEDIUM | CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H |
2.8
|
3.6
|
NIST |
CWE ids for CVE-2020-28349
-
The product receives input or data, but it does not validate or incorrectly validates that the input has the properties that are required to process the data safely and correctly.Assigned by: nvd@nist.gov (Primary)
References for CVE-2020-28349
-
https://github.com/brocaar/chirpstack-network-server/commit/f996bb0c6c85281b5658f59ff09db1b4a73db453
Improve uplink de-duplication. · brocaar/chirpstack-network-server@f996bb0 · GitHubPatch;Third Party Advisory
-
https://www.cyberark.com/resources/threat-research-blog/lorawan-mqtt-what-to-know-when-securing-your-iot-network
LoRaWAN & MQTT: What to Know When Securing Your IoT NetworkExploit;Third Party Advisory
-
https://github.com/brocaar/chirpstack-network-server/commit/874fc1a9b01045ebe8a340f0bb01ed19e8256e60
Improve error handling of unknown gateways. · brocaar/chirpstack-network-server@874fc1a · GitHubPatch;Third Party Advisory
Jump to