An inaccurate frame deduplication process in ChirpStack Network Server 3.9.0 allows a malicious gateway to perform uplink Denial of Service via malformed frequency attributes in CollectAndCallOnceCollect in internal/uplink/collect.go. NOTE: the vendor's position is that there are no "guarantees that allowing untrusted LoRa gateways to the network should still result in a secure network.
References
Link | Resource |
---|---|
https://github.com/brocaar/chirpstack-network-server/commit/874fc1a9b01045ebe8a340f0bb01ed19e8256e60 | Patch Third Party Advisory |
https://github.com/brocaar/chirpstack-network-server/commit/f996bb0c6c85281b5658f59ff09db1b4a73db453 | Patch Third Party Advisory |
https://www.cyberark.com/resources/threat-research-blog/lorawan-mqtt-what-to-know-when-securing-your-iot-network | Exploit Third Party Advisory |
History
No history.
MITRE Information
Status: PUBLISHED
Assigner: mitre
Published: 2020-11-09T00:54:56
Updated: 2020-11-09T00:54:56
Reserved: 2020-11-09T00:00:00
Link: CVE-2020-28349
JSON object: View
NVD Information
Status : Modified
Published: 2020-11-09T01:15:13.710
Modified: 2024-05-17T01:47:24.423
Link: CVE-2020-28349
JSON object: View
Redhat Information
No data.
CWE