What’s Vulnerable › Vulnerabilities

CVE-2018-19860

• Severity: high (CVSS 8.8 v3.0)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 1.0% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2019-06-07 · updated 2026-06-17
• Weakness: CWE-732

Description

Broadcom firmware before summer 2014 on Nexus 5 BCM4335C0 2012-12-11, Raspberry Pi 3 BCM43438A1 2014-06-02, and unspecifed other devices does not properly restrict LMP commnds and executes certain memory contents upon receiving an LMP command, as demonstrated by executing an HCI command.

Affected products

• Broadcom Bcm4335C0 Firmware: 2012-12-11
• Broadcom Bcm43438A1 Firmware: 2014-06-02
• Cypress Cyw20702A1Kwfbg Firmware: all versions
• Cypress Cyw20702A1Kwfbgt Firmware: all versions
• Cypress Cyw20702B0Kwfbg Firmware: all versions
• Cypress Cyw20702B0Kwfbgt Firmware: all versions
• Cypress Cyw20703Ua1Kffb1G Firmware: all versions
• Cypress Cyw20703Ua1Kffb1Gt Firmware: all versions
• Cypress Cyw20704Ua1Kffb1G Firmware: all versions
• Cypress Cyw20704Ua1Kffb1Gt Firmware: all versions
• Cypress Cyw20704Ua2Kffb1G Firmware: all versions
• Cypress Cyw20704Ua2Kffb1Gt Firmware: all versions
• Cypress Cyw20705A1Kwfbgt Firmware: all versions
• Cypress Cyw20705B0Kwfbg Firmware: all versions
• Cypress Cyw20705B0Kwfbgt Firmware: all versions
• Cypress Cyw20706Ua1Kffb1G Firmware: all versions
• Cypress Cyw20706Ua1Kffb1Gt Firmware: all versions
• Cypress Cyw20706Ua1Kffb4G Firmware: all versions
• Cypress Cyw20706Ua2Kffb4G Firmware: all versions
• Cypress Cyw20706Ua2Kffb4Gt Firmware: all versions
• Cypress Cyw20707A2Kubgt Firmware: all versions
• Cypress Cyw20707Ua1Kffb1G Firmware: all versions
• Cypress Cyw20707Ua1Kffb4G Firmware: all versions
• Cypress Cyw20707Ua1Kffb4Gt Firmware: all versions
• Cypress Cyw20707Ua2Kffb4G Firmware: all versions
• Cypress Cyw20707Ua2Kffb4Gt Firmware: all versions
• Cypress Cyw20707Va1Pkwbgt Firmware: all versions
• Cypress Cyw20707Va2Pkwbgt Firmware: all versions
• Cypress Cyw20730A1Kfbg Firmware: all versions
• Cypress Cyw20730A1Kfbgt Firmware: all versions

References

• http://seclists.org/fulldisclosure/2019/Aug/11
• http://seclists.org/fulldisclosure/2019/Jul/22
• https://seclists.org/bugtraq/2019/Aug/21
• https://source.android.com/security/bulletin/2019-05-01
• https://support.apple.com/kb/HT210348
• https://www.broadcom.com/support/resources/product-security-center
• http://seclists.org/fulldisclosure/2019/Aug/11
• http://seclists.org/fulldisclosure/2019/Jul/22
• https://seclists.org/bugtraq/2019/Aug/21
• https://source.android.com/security/bulletin/2019-05-01
• https://support.apple.com/kb/HT210348
• https://www.broadcom.com/support/resources/product-security-center

Get alerted when CVE-2018-19860 or the next vulnerability affects your stack