CVE-2020-28349

MEDIUM 6.5CVE-2020-28349 · Published 09/11/2020 · updated 17/06/2026

In short

CVE-2020-28349 is a MEDIUM (CVSS 6.5) vulnerability affecting network server (chirpstack).
Chance of exploitation in the next 30 days (EPSS): 2.2%, higher than 82.6% of all vulnerabilities.
No patched version is listed yet: follow the vendor's advisory in References.

Package	Affected versions	Patched versions
network server chirpstack	`= 3.9.0`	No fix yet

Description

An inaccurate frame deduplication process in ChirpStack Network Server 3.9.0 allows a malicious gateway to perform uplink Denial of Service via malformed frequency attributes in CollectAndCallOnceCollect in internal/uplink/collect.go. NOTE: the vendor's position is that there are no "guarantees that allowing untrusted LoRa gateways to the network should still result in a secure network.

References

brocaar/chirpstack-network-server commit 874fc1a · Patch
brocaar/chirpstack-network-server commit f996bb0 · Patch
cyberark.com/resources/threat-research-blog/lorawan-mqtt-what-to-know-when-securing-your-iot-network · Exploit

Running one of these products? Scan your site to see whether it exposes a vulnerable version.

Scan my site free