‹ Back to list

CVE-2019-9414

Status: ModifiedMedium (5.9)—
Severity5.9Medium · CVSS 3.1
Exploitation probability0.56 %higher than 46% of CVEs
Active exploitationNonot in the CISA catalog
Public exploitNot knownno public code found

In wpa_supplicant, there is a possible man in the middle vulnerability due to improper input validation of the basicConstraints field of intermediary certificates. This could lead to remote information disclosure with no additional execution privileges needed. User interaction is not needed for exploitation. Product: AndroidVersions: Android-10Android ID: A-111893041

CVSS

Base score
5.9
Version
3.1
Vector
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N

Exploitation probability (EPSS)

Probability of exploitation in the next 30 days
0.56 %
Percentile among all scored CVEs
46
Score date
10/20/2026

EPSS (Exploit Prediction Scoring System, FIRST) estimates how likely a vulnerability is to be exploited in the wild within 30 days. It complements CVSS (impact) and CISA KEV (confirmed exploitation).

Affected technologies (1)

Google — Android

CWEs

References

Show 2 references

Raw JSON (NVD)

Show
{
  "id": "CVE-2019-9414",
  "cveTags": [],
  "metrics": {
    "cvssMetricV2": [
      {
        "type": "Primary",
        "source": "nvd@nist.gov",
        "cvssData": {
          "version": "2.0",
          "baseScore": 4.3,
          "accessVector": "NETWORK",
          "vectorString": "AV:N/AC:M/Au:N/C:P/I:N/A:N",
          "authentication": "NONE",
          "integrityImpact": "NONE",
          "accessComplexity": "MEDIUM",
          "availabilityImpact": "NONE",
          "confidentialityImpact": "PARTIAL"
        },
        "acInsufInfo": false,
        "impactScore": 2.9,
        "baseSeverity": "MEDIUM",
        "obtainAllPrivilege": false,
        "exploitabilityScore": 8.6,
        "obtainUserPrivilege": false,
        "obtainOtherPrivilege": false,
        "userInteractionRequired": false
      }
    ],
    "cvssMetricV31": [
      {
        "type": "Primary",
        "source": "nvd@nist.gov",
        "cvssData": {
          "scope": "UNCHANGED",
          "version": "3.1",
          "baseScore": 5.9,
          "attackVector": "NETWORK",
          "baseSeverity": "MEDIUM",
          "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N",
          "integrityImpact": "NONE",
          "userInteraction": "NONE",
          "attackComplexity": "HIGH",
          "availabilityImpact": "NONE",
          "privilegesRequired": "NONE",
          "confidentialityImpact": "HIGH"
        },
        "impactScore": 3.6,
        "exploitabilityScore": 2.2
      }
    ]
  },
  "affected": [
    {
      "source": "security@android.com",
      "affectedData": [
        {
          "vendor": "n/a",
          "product": "Android",
          "versions": [
            {
              "status": "affected",
              "version": "Android-10"
            }
          ]
        }
      ]
    }
  ],
  "published": "2019-09-27T19:15:27.453",
  "references": [
    {
      "url": "https://source.android.com/security/bulletin/android-10",
      "tags": [
        "Vendor Advisory"
      ],
      "source": "security@android.com"
    },
    {
      "url": "https://source.android.com/security/bulletin/android-10",
      "tags": [
        "Vendor Advisory"
      ],
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    }
  ],
  "vulnStatus": "Modified",
  "weaknesses": [
    {
      "type": "Primary",
      "source": "nvd@nist.gov",
      "description": [
        {
          "lang": "en",
          "value": "CWE-20"
        }
      ]
    }
  ],
  "descriptions": [
    {
      "lang": "en",
      "value": "In wpa_supplicant, there is a possible man in the middle vulnerability due to improper input validation of the basicConstraints field of intermediary certificates. This could lead to remote information disclosure with no additional execution privileges needed. User interaction is not needed for exploitation. Product: AndroidVersions: Android-10Android ID: A-111893041"
    },
    {
      "lang": "es",
      "value": "En wpa_supplicant, se presenta una posible vulnerabilidad de tipo man in the middle debido a una comprobación de entrada inapropiada del campo basicConstraints de los certificados intermedios. Esto podría conllevar a una divulgación de información remota sin ser necesarios privilegios de ejecución adicionales. No es requerida una interacción del usuario para su explotación. Producto: Android, Versiones: Android-10, ID de Android: A-111893041"
    }
  ],
  "lastModified": "2026-06-17T02:43:41.847",
  "configurations": [
    {
      "nodes": [
        {
          "negate": false,
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:o:google:android:10.0:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "D558D965-FA70-4822-A770-419E73BA9ED3"
            }
          ],
          "operator": "OR"
        }
      ]
    }
  ],
  "sourceIdentifier": "security@android.com"
}