Security readout for executives and security teams
Plain-English summary
CVE-2019-20791 is a stack-based buffer overflow in OpenThread before 2019-12-13. The public record does not provide CVSS, affected product CPEs, or exploitation evidence. Treat it as an embedded dependency risk: products using older OpenThread builds may need vendor or firmware updates.
Executive priority
Set priority after confirming whether OpenThread is present in deployed products. If present and older than 2019-12-13, schedule vendor remediation through normal embedded-device patch governance; urgency is hard to score from public data alone.
Technical view
The flaw is in OpenThread MeshCoP::Commissioner::GeneratePskc. Source references include an OSS-Fuzz issue and two OpenThread commits. The provided sources identify the vulnerable condition as OpenThread before 2019-12-13 but do not document exploitability, impact boundaries, or affected downstream products.
Likely exposure
Exposure is likely limited to systems, firmware, or products embedding OpenThread before 2019-12-13, especially code paths using Thread commissioning PSKc generation. The CVE source bundle lists no formal vendor/product CPEs, so downstream exposure requires dependency or firmware inventory.
Exploitation context
The source bundle does not show active exploitation, and the CVE is not listed as KEV. OSS-Fuzz involvement suggests the issue was found through fuzz testing, but the provided materials do not establish real-world exploitation or practical attack conditions.
Researcher notes
The public record is sparse: no CVSS vector, no CWE entry, no CPEs, and no documented exploit status. Focus analysis on the referenced commits, the OSS-Fuzz issue, and downstream SBOM or firmware evidence rather than assuming broad product exposure.
Mitigation direction
- Upgrade embedded OpenThread to a build from 2019-12-13 or later.
- Verify vendor firmware incorporates the referenced OpenThread fixes.
- Check vendor advisories for downstream products using OpenThread.
- Prioritize updates where Thread commissioning features are enabled.
Validation and detection
- Inventory products and firmware that include OpenThread.
- Confirm the embedded OpenThread snapshot date or commit level.
- Check whether the two referenced commits are present.
- Ask vendors for written confirmation on affected firmware versions.
Public sources used
Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.
Conservative CVE-to-ATT&CK context
These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.
ATT&CK lookup starting points
Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.
CVE-2019-20791 mapping review
Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.
Open ATT&CK lookup- Severity
- Unknown
- CVSS
- Not scored
- Known Exploited
- No
- Published
CNA and ADP enrichment extracted from CVE v5
These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.
CVSS and timeline data
No CVSS vectors or timeline events were available in the normalized CVE source material.
Source materials
- CVE List V5 sourceCVE List V5
- https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=19386CVE reference · x_refsource_MISC
- https://github.com/openthread/openthread/commit/b8c3161281f8e15873f8decabd8eac461717aefeCVE reference · x_refsource_MISC
- https://github.com/openthread/openthread/commit/c3a3a0c424322009fec3ab735fb20ce8f6e19e70CVE reference · x_refsource_MISC
Products and packages named in the record
CWE details
CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.