Severity: Unknown
Description: An exploitable denial-of-service vulnerability exists in the hostapd 2.6, where an attacker could trigger AP to send IAPP location updates for stations, before the required authentication process has completed. This could lead to different denial of service scenarios, either by causing CAM table attacks, or by leading to traffic flapping if faking already existing clients in other nearby Aps of the same wireless infrastructure. An attacker can forge Authentication and Association Request packets to trigger this vulnerability.
CVSS Score: N/A
D
No data available.
No data available.
1. Risk Assessment
The vulnerability CVE-2019-5061 is a denial-of-service flaw in hostapd version 2.6, specifically affecting Ubiquiti AP-AC-Pro firmware 4.0.10.9653. The nature of the vulnerability lies in the AP sending IAPP location updates for wireless stations before full authentication is completed. This can trigger several denial-of-service scenarios. The CVSS v3.0 base score is 7.4 (HIGH), indicating a significant risk. Exploitation is considered relatively easy, with low attack complexity and requiring no privileges. The primary impact is on availability, with the potential to disrupt wireless service for connected clients. Confidentiality and integrity are not directly impacted. The likelihood of exploitation is moderate, as the attacker needs to be within adjacent network range and can forge packets, which is relatively common. The business impact can range from minor inconvenience to significant disruption, depending on the reliance on the affected wireless network. Critical systems relying on wireless connectivity could experience downtime, impacting productivity and potentially revenue.
2. Potential Attack Scenarios
An attacker positioned within wireless range of the affected AP can launch a denial-of-service attack by forging Authentication and Association Request packets. The attacker repeatedly sends these packets with slightly modified parameters, causing the AP to send IAPP location updates for these "stations" before they are fully authenticated. This can overwhelm the AP’s CAM (Content Addressable Memory) table, leading to a CAM table attack. Alternatively, if the AP is configured to hand off clients to nearby APs, the forged requests can cause traffic flapping as the AP attempts to route traffic to clients that aren’t truly connected, creating instability. The outcome is degraded wireless performance or complete service interruption for clients connected to the affected AP or nearby APs within the same wireless infrastructure. The attack vector is adjacent network, meaning the attacker needs to be within wireless range, and the process is relatively straightforward using standard wireless network tools.
3. Mitigation Recommendations
The primary mitigation for CVE-2019-5061 is to update to a patched version of hostapd. Ubiquiti should release a firmware update that addresses this vulnerability. Immediate action should be taken to apply this update as soon as it is available. In the interim, consider segmenting the wireless network to isolate the affected AP and limit the impact of a potential denial-of-service. Monitor network performance for signs of increased traffic flapping or CAM table exhaustion. Additional security measures, such as 802.1X authentication, can help to further validate client connections and reduce the impact of forged packets. Relevant resources include the Talos Intelligence report: https://talosintelligence.com/vulnerability_reports/TALOS-2019-0849 and PacketStorm security: https://packetstormsecurity.com/search/?q=CVE-2019-5061.
4. Executive Summary
CVE-2019-5061 is a denial-of-service vulnerability in Ubiquiti AP-AC-Pro devices running hostapd version 2.6 firmware 4.0.10.9653. An attacker within wireless range can disrupt wireless service by sending specially crafted packets, potentially leading to significant downtime for users and impacting business operations. The vulnerability is considered relatively easy to exploit and has a high potential impact on the availability of the wireless network. We recommend promptly applying the firmware update released by Ubiquiti to address this vulnerability. Proactive patching and network segmentation will minimize the risk of disruption and ensure continued reliable wireless connectivity for our users and systems. Ignoring this vulnerability could lead to noticeable performance issues and potentially widespread wireless outages.