Inaccurate Frame Deduplication in ChirpStack Network Server Affects LoRa Gateways
CVE-2020-28349

6.5MEDIUM

Key Information:

Vendor

Chirpstack

Status
Network Server
Vendor
CVE Published:
9 November 2020

What is CVE-2020-28349?

An issue in ChirpStack Network Server 3.9.0 related to an inaccurate frame deduplication process allows a malicious gateway to execute an uplink Denial of Service attack. This occurs when malformed frequency attributes are processed by the CollectAndCallOnceCollect function in internal/uplink/collect.go. The ChirpStack team has indicated that using untrusted LoRa gateways poses significant risks, contributing to potential security challenges within the network.

References

https://github.com/brocaar/chirpstack-network-server/comm...
x_refsource_MISC
https://github.com/brocaar/chirpstack-network-server/comm...
x_refsource_MISC
https://www.cyberark.com/resources/threat-research-blog/l...
x_refsource_MISC

CVSS V3.1

Score:
6.5
Severity:
MEDIUM
Confidentiality:
None
Integrity:
None
Availability:
None
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
Low
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.