CVE-2017-6957

HighCVSS 8.1/10Last modified Jun 17, 2026

Description

Stack-based buffer overflow in the firmware in Broadcom Wi-Fi HardMAC SoC chips, when the firmware supports CCKM Fast and Secure Roaming and the feature is enabled in RAM, allows remote attackers to execute arbitrary code via a crafted reassociation response frame with a Cisco IE (156).

Metrics

CVSS 3.0 8.1/10CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-119

Affected software

Vendor	Product	Versions
n/a	n/a	n/a

References

http://packetstormsecurity.com/files/141803/Broadcom-Stack-Buffer-Overflow.htmlExploit, Third Party Advisory, VDB Entry
http://www.securityfocus.com/bid/97054Third Party Advisory, VDB Entry
https://bugs.chromium.org/p/project-zero/issues/detail?id=1051Third Party Advisory
http://packetstormsecurity.com/files/141803/Broadcom-Stack-Buffer-Overflow.htmlExploit, Third Party Advisory, VDB Entry
http://www.securityfocus.com/bid/97054Third Party Advisory, VDB Entry
https://bugs.chromium.org/p/project-zero/issues/detail?id=1051Third Party Advisory

Timeline

Published: Mar 27, 2017
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2017

CVE-2017-69586.1An XSS vulnerability in the MantisBT Source Integration Plugin (before 2.0.2) search result page allows an attacker to inject arbitrary HTML CVE-2017-69607.5An issue was discovered in apng2gif 1.7. There is an integer overflow resulting in a heap-based buffer over-read, related to the load_apng f CVE-2017-69615.5An issue was discovered in apng2gif 1.7. There is improper sanitization of user input causing huge memory allocations, resulting in a crash.CVE-2017-69627.5An issue was discovered in apng2gif 1.7. There is an integer overflow resulting in a heap-based buffer overflow. This is related to the read CVE-2017-69647.8dmcrypt-get-device, as shipped in the eject package of Debian and Ubuntu, does not check the return value of the (1) setuid or (2) setgid fu CVE-2017-69655.5readelf in GNU Binutils 2.28 writes to illegal addresses while processing corrupt input files containing symbol-difference relocations, lead CVE-2017-69665.5readelf in GNU Binutils 2.28 has a use-after-free (specifically read-after-free) error while processing multiple, relocated sections in an M CVE-2017-69677.3xrdp 0.9.1 calls the PAM function auth_start_session() in an incorrect location, leading to PAM session modules not being properly initializ CVE-2017-69688.8GMV Checker ATM Security prior to 5.0.18 allows remote authenticated users to execute arbitrary code via unspecified vectors, aka PT-2017-03 CVE-2017-69699.1readelf in GNU Binutils 2.28 is vulnerable to a heap-based buffer over-read while processing corrupt RL78 binaries. The vulnerability can tr CVE-2017-69708.4AlienVault USM and OSSIM before 5.3.7 and NfSen before 1.3.8 allow local users to execute arbitrary commands in a privileged context via an CVE-2017-69718.8AlienVault USM and OSSIM before 5.3.7 and NfSen before 1.3.8 allow remote authenticated users to execute arbitrary commands in a privileged