CVE-2019-6015
Status: ModifiedHigh (7.5)—
FON2601E-SE, FON2601E-RE, FON2601E-FSW-S, and FON2601E-FSW-B with firmware versions 1.1.7 and earlier contain an issue where they may behave as open resolvers. If this vulnerability is exploited, FON routers may be leveraged for DNS amplification attacks to some other entities.
CVSS
- Version: 3.1
- Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
- Base score: 7.5
Exploitation probability (EPSS)
- Probability of exploitation in the next 30 days: 1.61%
- Percentile among all scored CVEs: 75
- Score date: 10/9/2026
EPSS (Exploit Prediction Scoring System, FIRST) estimates how likely a vulnerability is to be exploited in the wild within 30 days. It complements CVSS (impact) and CISA KEV (confirmed exploitation).
Affected technologies (4)
CWEs
- CWE-400
References
Raw JSON (NVD)
Show
{
"id": "CVE-2019-6015",
"cveTags": [],
"metrics": {
"cvssMetricV2": [
{
"type": "Primary",
"source": "nvd@nist.gov",
"cvssData": {
"version": "2.0",
"baseScore": 7.8,
"accessVector": "NETWORK",
"vectorString": "AV:N/AC:L/Au:N/C:N/I:N/A:C",
"authentication": "NONE",
"integrityImpact": "NONE",
"accessComplexity": "LOW",
"availabilityImpact": "COMPLETE",
"confidentialityImpact": "NONE"
},
"acInsufInfo": false,
"impactScore": 6.9,
"baseSeverity": "HIGH",
"obtainAllPrivilege": false,
"exploitabilityScore": 10,
"obtainUserPrivilege": false,
"obtainOtherPrivilege": false,
"userInteractionRequired": false
}
],
"cvssMetricV31": [
{
"type": "Primary",
"source": "nvd@nist.gov",
"cvssData": {
"scope": "UNCHANGED",
"version": "3.1",
"baseScore": 7.5,
"attackVector": "NETWORK",
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"integrityImpact": "NONE",
"userInteraction": "NONE",
"attackComplexity": "LOW",
"availabilityImpact": "HIGH",
"privilegesRequired": "NONE",
"confidentialityImpact": "NONE"
},
"impactScore": 3.6,
"exploitabilityScore": 3.9
}
]
},
"affected": [
{
"source": "vultures@jpcert.or.jp",
"affectedData": [
{
"vendor": "FON Wireless Limited",
"product": "FON2601E-SE, FON2601E-RE, FON2601E-FSW-S, and FON2601E-FSW-B",
"versions": [
{
"status": "affected",
"version": "firmware versions 1.1.7 and earlier"
}
]
}
]
}
],
"published": "2019-10-04T19:15:10.400",
"references": [
{
"url": "http://jvn.jp/en/vu/JVNVU94678942/index.html",
"tags": [
"Third Party Advisory"
],
"source": "vultures@jpcert.or.jp"
},
{
"url": "https://fonjapan.zendesk.com/hc/ja/articles/360000558942",
"tags": [
"Third Party Advisory"
],
"source": "vultures@jpcert.or.jp"
},
{
"url": "http://jvn.jp/en/vu/JVNVU94678942/index.html",
"tags": [
"Third Party Advisory"
],
"source": "af854a3a-2127-422b-91ae-364da2661108"
},
{
"url": "https://fonjapan.zendesk.com/hc/ja/articles/360000558942",
"tags": [
"Third Party Advisory"
],
"source": "af854a3a-2127-422b-91ae-364da2661108"
}
],
"vulnStatus": "Modified",
"weaknesses": [
{
"type": "Primary",
"source": "nvd@nist.gov",
"description": [
{
"lang": "en",
"value": "CWE-400"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "FON2601E-SE, FON2601E-RE, FON2601E-FSW-S, and FON2601E-FSW-B with firmware versions 1.1.7 and earlier contain an issue where they may behave as open resolvers. If this vulnerability is exploited, FON routers may be leveraged for DNS amplification attacks to some other entities."
},
{
"lang": "es",
"value": "FON2601E-SE, FON2601E-RE, FON2601E-FSW-S y FON2601E-FSW-B con versiones de firmware 1.1.7 y anteriores, contienen un problema en el que pueden comportarse como solucionadores abiertos. Si esta vulnerabilidad es explotada, los enrutadores FON pueden ser aprovechados para ataques de amplificación DNS hacia algunas otras entidades."
}
],
"lastModified": "2026-06-17T02:38:35.040",
"configurations": [
{
"nodes": [
{
"negate": false,
"cpeMatch": [
{
"criteria": "cpe:2.3:o:fon:fon2601e-se_firmware:*:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "D84E4653-CDBE-4F8D-9F41-E1414BFB9AED",
"versionEndIncluding": "1.1.7"
}
],
"operator": "OR"
},
{
"negate": false,
"cpeMatch": [
{
"criteria": "cpe:2.3:h:fon:fon2601e-se:-:*:*:*:*:*:*:*",
"vulnerable": false,
"matchCriteriaId": "3D6ED332-83DC-4578-8812-E3A9106B10DC"
}
],
"operator": "OR"
}
],
"operator": "AND"
},
{
"nodes": [
{
"negate": false,
"cpeMatch": [
{
"criteria": "cpe:2.3:o:fon:fon2601e-re_firmware:*:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "F162956C-1F49-41D4-9B38-D8CA3D59BE42",
"versionEndIncluding": "1.1.7"
}
],
"operator": "OR"
},
{
"negate": false,
"cpeMatch": [
{
"criteria": "cpe:2.3:h:fon:fon2601e-re:-:*:*:*:*:*:*:*",
"vulnerable": false,
"matchCriteriaId": "E8C0AA2F-AF6C-4639-8325-7C3E3C75D0EE"
}
],
"operator": "OR"
}
],
"operator": "AND"
},
{
"nodes": [
{
"negate": false,
"cpeMatch": [
{
"criteria": "cpe:2.3:o:fon:fon2601e-fsw-s_firmware:*:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "E0B71C3E-CD83-4D69-ABF2-F00CD4076A25",
"versionEndIncluding": "1.1.7"
}
],
"operator": "OR"
},
{
"negate": false,
"cpeMatch": [
{
"criteria": "cpe:2.3:h:fon:fon2601e-fsw-s:-:*:*:*:*:*:*:*",
"vulnerable": false,
"matchCriteriaId": "AE9F1836-5898-46C9-9F3A-6964B6C47F01"
}
],
"operator": "OR"
}
],
"operator": "AND"
},
{
"nodes": [
{
"negate": false,
"cpeMatch": [
{
"criteria": "cpe:2.3:o:fon:fon2601e-fsw-b_firmware:*:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "F1A4E5CD-7D82-41FC-B1B3-8759738B6017",
"versionEndIncluding": "1.1.7"
}
],
"operator": "OR"
},
{
"negate": false,
"cpeMatch": [
{
"criteria": "cpe:2.3:h:fon:fon2601e-fsw-b:-:*:*:*:*:*:*:*",
"vulnerable": false,
"matchCriteriaId": "20899B1F-EB71-45FE-A1D5-90E56A35A9A0"
}
],
"operator": "OR"
}
],
"operator": "AND"
}
],
"sourceIdentifier": "vultures@jpcert.or.jp"
}