PatchTheCVECVE-2019-18614: On the Cypress CYW20735 evaluation board, any data that exceeds 384 bytes is copied and causes an overflow
CVE-2019-18614 is a high-severity flaw (CVSS 7.8) affecting cyw20735 firmware. Below: why it ranks where it does, which versions are affected, what to do, and the exact commands.
On the Cypress CYW20735 evaluation board, any data that exceeds 384 bytes is copied and causes an overflow. This is because the maximum BLOC buffer size for sending and receiving data is set to 384 bytes, but everything else is still configured to the usual size of 1092 (which was used for everything in the previous CYW20719 and later CYW20819 evaluation board). To trigger the overflow, an attacker can either send packets over the air or as unpri
Why this priority
- High severity
No fix is published yet: follow the downgrade or mitigation steps.
Risk facts
| CVSS score | 7.8 (High) |
| Attack vector | Local |
| Attack complexity | Low |
| Privileges needed | Low |
| User interaction | None |
| EPSS exploit chance | 0.3% (top 73%) |
| CISA exploited list | No |
| Weakness | CWE-787 |
| Published | 2020-06-16 |
| Last modified | 2026-06-17 |
Last updated 2026-06-17 · Sources: CVE Program, NVD, CISA KEV, EPSS and vendor advisories · How we score
Am I affected?
Timeline
- Published CVE record published
- Updated Record last modified
Scores and fixes here are computed automatically from those and other public sources. Confirm with the vendor advisory before changing production systems.
Quick answers
How do I fix CVE-2019-18614?
cyw20735 firmware: mitigate or apply the listed mitigation. Exact commands for each OS are on this page.
Is CVE-2019-18614 being exploited?
CVE-2019-18614 is not on the CISA Known Exploited Vulnerabilities list at the time of the last update. Check again, as this can change.
What does CVE-2019-18614 affect?
CVE-2019-18614 affects cyw20735 firmware. Severity is high (CVSS 7.8). On the Cypress CYW20735 evaluation board, any data that exceeds 384 bytes is copied and causes an overflow. This is because the maximum BLOC buffer size for sending and receiving data is set to 384 bytes, but everything else is still config
How urgent is CVE-2019-18614?
Priority 34/100. High severity