LiveActive security incident?Get immediate response
CVE Record

CVE-2019-18991: A partial authentication bypass vulnerability exists on Atheros AR9132 3.60(AMX.8), AR9283 1.85, and AR9285...

A partial authentication bypass vulnerability exists on Atheros AR9132 3.60(AMX.8), AR9283 1.85, and AR9285 1.0.0.12NA devices. The vulnerability allows sending an unencrypted data frame to a WPA2-protected WLAN router where the packet is routed through the network. If successful, a response is sent back as an encrypted frame, which would allow an attacker to discern information or potentially modify data.

MediumCVSS 6.1Not KEV-listedUpdated
Discuss exposureBack to CVEs
Glexia's TakeAutomated analysismoderate

Security readout for executives and security teams

Plain-English summary

Some listed Atheros wireless devices may route an unencrypted frame through a WPA2-protected network. That weakens the expected protection of the wireless boundary and could expose or alter limited traffic. The issue is medium severity and requires wireless adjacency, not general internet access.

Executive priority

Handle as a moderate wireless infrastructure risk. Prioritize sites where affected devices bridge into sensitive internal networks or cannot receive vendor-supported firmware updates.

Technical view

CVE-2019-18991 is a partial authentication bypass affecting Atheros AR9132 3.60(AMX.8), AR9283 1.85, and AR9285 1.0.0.12NA. An unauthenticated adjacent attacker may send an unencrypted data frame that the router routes, with any response returned encrypted. CVSS 3.0 score is 6.1.

Likely exposure

Exposure is most likely in WLAN environments still using the named Atheros devices and firmware versions. The CVE data has incomplete product metadata, so asset inventory must confirm actual chipset and firmware presence.

Exploitation context

The source bundle does not show active exploitation, and the CVE is not listed as KEV. The CVSS vector indicates adjacent network access, no privileges, no user interaction, low complexity, and limited confidentiality and integrity impact.

Researcher notes

Evidence is limited to CVE metadata and the Synopsys advisory reference. No exploit code, KEV listing, or definitive remediation details are provided in the bundle. The affected product fields are marked n/a despite specific chipset and firmware names in the description.

Mitigation direction

  • Identify wireless routers or access points using the listed Atheros models and firmware versions.
  • Check vendor or device-maker guidance for fixed firmware or supported replacement options.
  • Treat affected WPA2 WLANs as weakened until vendor guidance is applied.
  • Reduce exposure by limiting sensitive traffic over affected wireless segments.

Validation and detection

  • Confirm chipset and firmware versions from asset records or device administration interfaces.
  • Review whether affected WLANs carry sensitive or privileged network traffic.
  • Check whether compensating segmentation limits routed access from wireless clients.
  • Document any device where vendor fix status cannot be confirmed.
Prepared
Confidence
medium
Sources
3

Public sources used

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.

Potential ATT&CK relevance

Conservative CVE-to-ATT&CK context

These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.

ATT&CK lookup starting points

Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.

description · low confidence lookup

Credential and access behavior lookup

The CVE wording references authentication or credential exposure, so valid-account and credential-access review may help. This is a Glexia inferred lookup path, not an official MITRE, ATT&CK, or CVE Program mapping.

Open ATT&CK lookup
cve · low confidence lookup

CVE-2019-18991 mapping review

Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.

Open ATT&CK lookup
Vulnerability profileCVE Program record
Severity
Medium
CVSS
6.1 (3.0)
Known Exploited
No
Published

Vector: CVSS:3.0/AC:L/AV:A/A:N/C:L/I:L/PR:N/S:C/UI:N

Official CVE source material

CNA and ADP enrichment extracted from CVE v5

These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.

1CVSS vectors
0Timeline events
0ADP providers
2Source links

CVSS vector scores

1 official score

We collect every scored CVSS vector available in the official CNA and ADP containers. When more than one version is present, the table keeps the source vectors side by side instead of collapsing them into the highest score.

ScoreVersionSeverityVectorExploitImpactSource
6.1CVSS 3.0MediumCVSS:3.0/AC:L/AV:A/A:N/C:L/I:L/PR:N/S:C/UI:N2.82.7Primary CVE score

Vulnerability scoring details

Base CVSS 3.0 score

6.1Medium
CVSS 3.0 vector shape for CVE-2019-18991Attack VectorAttack ComplexityPrivileges RequiredUser InteractionScopeConfidentiality ImpactIntegrity ImpactAvailability Impact

Vector: CVSS:3.0/AC:L/AV:A/A:N/C:L/I:L/PR:N/S:C/UI:N

Attack Vector
NetworkAdjacentLocalPhysical
Attack Complexity
LowHigh
Privileges Required
NoneLowHigh
User Interaction
NoneRequired
Scope
ChangedUnchanged
Confidentiality Impact
HighLowNone
Integrity Impact
HighLowNone
Availability Impact
HighLowNone

Source materials

Affected products

Products and packages named in the record

VendorProductVersion / packageStatus
n/an/an/aListed
Weakness

CWE details

No CWE listed

CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.