Every CVE Search/ Get API key

CVE-2016-0801

The Broadcom Wi-Fi driver in the kernel in Android 4.x before 4.4.4, 5.x before 5.1.1 LMY49G, and...

9.8 CriticalPublic exploitFix available

The Broadcom Wi-Fi driver in the kernel in Android 4.x before 4.4.4, 5.x before 5.1.1 LMY49G, and 6.x before 2016-02-01 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via crafted wireless control message packets, aka internal bug 25662029.

Attack profile

How easy it is to exploit

Attack vector
Network
Complexity
Low
Privileges needed
None
User interaction
None

What an attacker can affect

Confidentiality
High
Integrity
High
Availability
High

Exploit likelihood

33.4%Down 17.8 points since Feb 4, 2022
90%50%10%1%

What each source reports

NVD Score used 9.8

The Broadcom Wi-Fi driver in the kernel in Android 4.x before 4.4.4, 5.x before 5.1.1 LMY49G, and 6.x before 2016-02-01 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via crafted wireless control message packets, aka internal bug 25662029.

Record
CVE-2016-0801
CVSS 3.0
9.8 CriticalCVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
CVSS 2.0
8.3 HighAV:A/AC:L/Au:N/C:C/I:C/A:C
Weakness
CWE-20
Updated
2026-11-02
CVE List No score

The Broadcom Wi-Fi driver in the kernel in Android 4.x before 4.4.4, 5.x before 5.1.1 LMY49G, and 6.x before 2016-02-01 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via crafted wireless control message packets, aka internal bug 25662029.

Record
CVE-2016-0801
Updated
2026-11-02
EUVDEUVD-2016-0812 No score

The Broadcom Wi-Fi driver in the kernel in Android 4.x before 4.4.4, 5.x before 5.1.1 LMY49G, and 6.x before 2016-02-01 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via crafted wireless control message packets, aka internal bug 25662029.

Record
EUVD-2016-0812
Updated
2026-11-03
GitHub AdvisoriesGHSA-f9jm-8gc5-4v7g 9.8

The Broadcom Wi-Fi driver in the kernel in Android 4.x before 4.4.4, 5.x before 5.1.1 LMY49G, and...

The Broadcom Wi-Fi driver in the kernel in Android 4.x before 4.4.4, 5.x before 5.1.1 LMY49G, and 6.x before 2016-02-01 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via crafted wireless control message packets, aka internal bug 25662029.

Record
GHSA-f9jm-8gc5-4v7g
CVSS 3.0
9.8 CriticalCVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Weakness
CWE-20
Updated
2026-11-02
OSV 9.8

The Broadcom Wi-Fi driver in the kernel in Android 4.x before 4.4.4, 5.x before 5.1.1 LMY49G, and 6.x before 2016-02-01 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via crafted wireless control message packets, aka internal bug 25662029.

Record
CVE-2016-0801
CVSS 3.0
9.8 CriticalCVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Updated
2026-11-02
OSVDEBIAN-CVE-2016-0801 9.8

The Broadcom Wi-Fi driver in the kernel in Android 4.x before 4.4.4, 5.x before 5.1.1 LMY49G, and 6.x before 2016-02-01 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via crafted wireless control message packets, aka internal bug 25662029.

Record
DEBIAN-CVE-2016-0801
CVSS 3.0
9.8 CriticalCVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Updated
2026-11-02
OSVMGASA-2017-0472 No score

Updated nonfree firmwares fixes security issues and adds new hw support

Updated nonfree firmwares fixes at least the following security issues:

Broadcom firmware fixes:

  • dropping BRCM proprietary packets received over the air (CVE-2016-0801)
  • adding length checks for TDLS action frames (CVE-2017-0561)
  • adding length checks for WME IE (CVE-2017-9417)

Iwlwifi firmware fixes:

  • The reinstallation of the Group Temporal key could be used for replay attacks (CVE-2017-13080)
  • The reinstallation of the Integrity Group Temporal key could be used for replay attacks (CVE-2017-13081)

This update also adds updated firmwares:

  • ath10k, cxgb4, liquidio, mrvl, ql2400, ql2500, wilc1000
  • Amd Polaris10-12, Intel BXT/SKL/KBL/CNL

and new firmwares:

  • Amd Vega10 and Raven
  • Cavium nitrox
  • Intel CNL/GLK, IPU3, JeffersonPeak, ThunderPeak
  • Mellanox Spectrum
  • nVidia GP108 (GTX1030)
  • Qualcom Adreno &Venus, imx SDMA,
  • Realtek rtl8822be

in order to support new hardware supported by 4.14 series kernels.

Record
MGASA-2017-0472
Updated
2026-11-02

Affected products

Affected packages

Affected packages
PackageAffectedFixed
firmware-nonfree
Debian:12
 before 20180518-1, plus listed versions
0.10.100.110.120.13
Show 45 moreShow less
0.13~bpo40+10.140.14+lenny10.14+lenny20.150.160.16~bpo50+10.170.17~bpo50+10.180.190.20.200.210.220.230.23~bpo50+10.240.24~bpo50+10.250.260.270.27~bpo50+10.280.28+squeeze10.290.30.300.310.320.32~bpo60+10.330.340.350.35~bpo60+10.360.36+wheezy.10.36+wheezy.1~bpo60+10.370.380.38~bpo70+10.390.39~bpo70+10.40.4+etchnhalf.1
20180518-1
firmware-nonfree
Debian:13
 before 20180518-1, plus listed versions
0.10.100.110.120.13
Show 45 moreShow less
0.13~bpo40+10.140.14+lenny10.14+lenny20.150.160.16~bpo50+10.170.17~bpo50+10.180.190.20.200.210.220.230.23~bpo50+10.240.24~bpo50+10.250.260.270.27~bpo50+10.280.28+squeeze10.290.30.300.310.320.32~bpo60+10.330.340.350.35~bpo60+10.360.36+wheezy.10.36+wheezy.1~bpo60+10.370.380.38~bpo70+10.390.39~bpo70+10.40.4+etchnhalf.1
20180518-1
firmware-nonfree
Debian:14
 before 20180518-1, plus listed versions
0.10.100.110.120.13
Show 45 moreShow less
0.13~bpo40+10.140.14+lenny10.14+lenny20.150.160.16~bpo50+10.170.17~bpo50+10.180.190.20.200.210.220.230.23~bpo50+10.240.24~bpo50+10.250.260.270.27~bpo50+10.280.28+squeeze10.290.30.300.310.320.32~bpo60+10.330.340.350.35~bpo60+10.360.36+wheezy.10.36+wheezy.1~bpo60+10.370.380.38~bpo70+10.390.39~bpo70+10.40.4+etchnhalf.1
20180518-1
firmware-nonfree
Debian:8
From an advisory covering 8 CVEs
 before 20161130-4~deb8u1, plus listed versions
0.10.100.110.120.13
Show 45 moreShow less
0.13~bpo40+10.140.14+lenny10.14+lenny20.150.160.16~bpo50+10.170.17~bpo50+10.180.190.20.200.210.220.230.23~bpo50+10.240.24~bpo50+10.250.260.270.27~bpo50+10.280.28+squeeze10.290.30.300.310.320.32~bpo60+10.330.340.350.35~bpo60+10.360.36+wheezy.10.36+wheezy.1~bpo60+10.370.380.38~bpo70+10.390.39~bpo70+10.40.4+etchnhalf.1
20161130-4~deb8u1
kernel-firmware-nonfree
Mageia:6
From an advisory covering 5 CVEs
 before 20171220-1.mga6.nonfree
20171220-1.mga6.nonfree
radeon-firmware
Mageia:6
From an advisory covering 5 CVEs
 before 20171205-1.mga6.nonfree
20171205-1.mga6.nonfree

Public exploits

Links only. Every CVE stores no exploit code.

Public exploits
SourceLinkDate
Exploit-DBGoogle Android Broadcom Wi-Fi Driver - Memory Corruption2016-05-11
PoC in GitHubabdsec/CVE-2016-08012016-05-11
PoC in GitHubzsaurus/CVE-2016-0801-test2016-05-15

History

History
RecordedChangedSources
affected, facts
aliasesEUVD
first indexedCVE List, Exploit-DB, GitHub Advisories, NVD, OSV, PoC in GitHub

Dates are when Every CVE recorded each change. Upstream dates may differ.

In short

CVE-2016-0801 is a critical vulnerability (CVSS 9.8) in Google Android, published February 7, 2016. Public exploit code exists. EPSS puts the chance of exploitation in the next 30 days at 33.4%, the 98th percentile. Fixed in firmware-nonfree 20180518-1.

References

Show 12 moreShow less
This page doesn't list everything

Left out here: 137 versions. The JSON record has them.

Pages All vulnerabilities Browse Docs Sources Guide Get API key
MoveEnter Open