Public exploit available
Public proof-of-concept or exploit code exists (ExploitDB / Metasploit / Nuclei).

CVE-2019-15126 — Time-of-check Time-of-use (TOCTOU) Race Condition in Apple Macos Catalina 10.15.1 Security Update 2019-001 AND Security Update 2019-006

CWE-367 — Time-of-check Time-of-use (TOCTOU) Race ConditionCWE-358 — Improperly Implemented Security Check for StandardCWE-300 — Channel Accessible by Non-EndpointCWE-326 — Inadequate Encryption Strength19 documents13 sources
Severity
3.1LOWNVD
EPSS
8.4%
top 7.66%
CISA KEV
Not in KEV
Exploit
PoC available
Public exploit / PoC exists
Affected products
7
Apple IpadosApple Iphone OSApple MAC OS X+4 more
Timeline
PublishedFeb 5
Latest updateApr 16

Description

An issue was discovered on Broadcom Wi-Fi client devices. Specifically timed and handcrafted traffic can cause internal errors (related to state transitions) in a WLAN device that lead to improper layer 2 Wi-Fi encryption with a consequent possibility of information disclosure over the air for a discrete set of traffic, a different vulnerability than CVE-2019-9500, CVE-2019-9501, CVE-2019-9502, and CVE-2019-9503.

CVSS vector

CVSS:3.1/AV:A/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:NExploitability: 1.6 | Impact: 1.4

Affected Packages7 packages

▶NVDapple/ipados< 13.2
▶NVDapple/mac_os_x< 10.15.1
▶NVDapple/iphone_os< 13.2

🔴Vulnerability Details

1
GHSA
GHSA-p2g8-8j8x-3728: An issue was discovered on Broadcom Wi-Fi client devices↗2022-05-24
▶

💥Exploits & PoCs

1
Exploit-DB
Broadcom Wi-Fi Devices - 'KR00K Information Disclosure↗2020-03-18
▶

📋Vendor Advisories

8
Microsoft
MITRE: CVE-2019-15126 Specifically timed and handcrafted traffic can cause internal errors (related to state transitions) in a WLAN device↗2023-02-14
▶
CISA ICS
Siemens SIMATIC, SIMOTICS (Update A)↗2020-08-11
▶
Cisco
Wi-Fi Protected Network and Wi-Fi Protected Network 2 Information Disclosure Vulnerability↗2020-02-27
▶
Red Hat
linux-firmware: Transmission of data encrypted with an all-zero session key after disassociation↗2020-02-05
▶
Apple
CVE-2019-15126: macOS Catalina 10.15.2, Security Update 2019-002 Mojave, Security Update 2019-007 High Sierra↗2019-12-10
▶

🕵️Threat Intelligence

5
Eset
Supply chain dependencies: Have you checked your blind spot?↗2026-04-16
▶
Schneier
Wi-Fi Chip Vulnerability - Schneier on Security↗2020-03-01
▶
Trendmicro
Trend Micro Detects 10% Rise in Ransomware in 2019↗2020-02-28
▶
Trendmicro
Trend Micro Detects 10% Rise in Ransomware in 2019↗2020-02-28
▶
Trendmicro
Trend Micro Detects 10% Rise in Ransomware in 2019↗2020-02-28
▶

📄Research Papers

2
arXiv
In Numeris Veritas: An Empirical Measurement of Wi-Fi Integration in Industry↗2025-09-21
▶
arXiv
A Review on C3I Systems' Security: Vulnerabilities, Attacks, and Countermeasures↗2022-01-31
▶

💬Community

1
Bugzilla
CVE-2019-15126 linux-firmware: Transmission of data encrypted with an all-zero session key after disassociation↗2020-02-27
▶