{"id":"CVE-2019-6496","aliases":["EUVD-2019-16056","GHSA-vx6q-ffvw-7c86"],"status":"published","title":"The ThreadX-based firmware on Marvell Avastar Wi-Fi devices, models 88W8787, 88W8797, 88W8801,...","description":"The ThreadX-based firmware on Marvell Avastar Wi-Fi devices, models 88W8787, 88W8797, 88W8801, 88W8897, and 88W8997, allows remote attackers to execute arbitrary code or cause a denial of service (block pool overflow) via malformed Wi-Fi packets during identification of available Wi-Fi networks. Exploitation of the Wi-Fi device can lead to exploitation of the host application processor in some cases, but this depends on several factors including host OS hardening and the availability of DMA.","severity":{"version":"3.0","score":8.8,"vector":"CVSS:3.0/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"high","assessor":"primary","from":"nvd"},"epss":{"day":"2026-11-08","score":0.06617,"percentile":0.93902,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":false},"cwes":["CWE-787"],"published":"2019-01-19T17:00:00Z","modified":"2026-06-17T02:39:08Z","products":[{"vendor":"marvell","product":"88w8787_firmware"},{"vendor":"marvell","product":"88w8797_firmware"},{"vendor":"marvell","product":"88w8801_firmware"},{"vendor":"marvell","product":"88w8897_firmware"},{"vendor":"marvell","product":"88w8997_firmware"}],"references":[{"url":"https://www.scribd.com/document/398350818/WiFi-CVE-2019-6496-Marvell-s-Statement","tags":["x_refsource_CONFIRM","x_transferred","Third Party Advisory"]},{"url":"http://www.securityfocus.com/bid/106865","tags":["vdb-entry","x_refsource_BID","x_transferred","Third Party Advisory","VDB Entry"]},{"url":"https://2018.zeronights.ru/wp-content/uploads/materials/19-Researching-Marvell-Avastar-Wi-Fi.pdf","tags":["x_refsource_MISC","x_transferred","Exploit","Third Party Advisory"]},{"url":"https://embedi.org/blog/remotely-compromise-devices-by-using-bugs-in-marvell-avastar-wi-fi-from-zero-knowledge-to-zero-click-rce/","tags":["x_refsource_MISC","x_transferred","Third Party Advisory"]},{"url":"https://www.zdnet.com/article/wifi-firmware-bug-affects-laptops-smartphones-routers-gaming-devices/","tags":["x_refsource_MISC","x_transferred","Exploit","Press/Media Coverage","Third Party Advisory"]},{"url":"https://www.synology.com/security/advisory/Synology_SA_19_07","tags":["x_refsource_CONFIRM","x_transferred","Third Party Advisory"]},{"url":"https://www.kb.cert.org/vuls/id/730261/","tags":["third-party-advisory","x_refsource_CERT-VN","x_transferred","Third Party Advisory","US Government Resource"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2019-6496"},{"url":"https://github.com/advisories/GHSA-vx6q-ffvw-7c86"}],"sources":{"cve":[{"id":"CVE-2019-6496","description":"The ThreadX-based firmware on Marvell Avastar Wi-Fi devices, models 88W8787, 88W8797, 88W8801, 88W8897, and 88W8997, allows remote attackers to execute arbitrary code or cause a denial of service (block pool overflow) via malformed Wi-Fi packets during identification of available Wi-Fi networks. Exploitation of the Wi-Fi device can lead to exploitation of the host application processor in some cases, but this depends on several factors including host OS hardening and the availability of DMA.","status":"published","published":"2019-01-19T17:00:00Z","modified":"2024-08-04T20:23:21.334Z","updated_at":"2026-11-02T14:20:23.381621Z"}],"euvd":[{"id":"EUVD-2019-16056","description":"The ThreadX-based firmware on Marvell Avastar Wi-Fi devices, models 88W8787, 88W8797, 88W8801, 88W8897, and 88W8997, allows remote attackers to execute arbitrary code or cause a denial of service (block pool overflow) via malformed Wi-Fi packets during identification of available Wi-Fi networks. Exploitation of the Wi-Fi device can lead to exploitation of the host application processor in some cases, but this depends on several factors including host OS hardening and the availability of DMA.","status":"published","published":"2019-01-19T17:00:00Z","modified":"2024-08-04T20:23:21Z","updated_at":"2026-11-03T03:06:49.204502Z"}],"ghsa":[{"id":"GHSA-vx6q-ffvw-7c86","title":"The ThreadX-based firmware on Marvell Avastar Wi-Fi devices, models 88W8787, 88W8797, 88W8801,...","description":"The ThreadX-based firmware on Marvell Avastar Wi-Fi devices, models 88W8787, 88W8797, 88W8801, 88W8897, and 88W8997, allows remote attackers to execute arbitrary code or cause a denial of service (block pool overflow) via malformed Wi-Fi packets during identification of available Wi-Fi networks. Exploitation of the Wi-Fi device can lead to exploitation of the host application processor in some cases, but this depends on several factors including host OS hardening and the availability of DMA.","status":"published","published":"2022-05-13T01:22:43Z","modified":"2023-02-01T05:06:49Z","cvss":[{"version":"3.0","score":8.8,"vector":"CVSS:3.0/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"high"}],"cwes":["CWE-787"],"updated_at":"2026-11-02T14:50:25.548742Z"}],"nvd":[{"id":"CVE-2019-6496","description":"The ThreadX-based firmware on Marvell Avastar Wi-Fi devices, models 88W8787, 88W8797, 88W8801, 88W8897, and 88W8997, allows remote attackers to execute arbitrary code or cause a denial of service (block pool overflow) via malformed Wi-Fi packets during identification of available Wi-Fi networks. Exploitation of the Wi-Fi device can lead to exploitation of the host application processor in some cases, but this depends on several factors including host OS hardening and the availability of DMA.","status":"published","published":"2019-01-20T20:29:00.917Z","modified":"2026-06-17T02:39:08.407Z","cvss":[{"version":"3.0","score":8.8,"vector":"CVSS:3.0/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"high","assessor":"primary"},{"version":"2.0","score":8.3,"vector":"AV:A/AC:L/Au:N/C:C/I:C/A:C","level":"high","assessor":"primary"}],"cwes":["CWE-787"],"updated_at":"2026-11-02T14:05:02.989216Z"}]}}