Causal model
What has to happen for this consequence to hold?
2 candidate paths · explicit source, inference, and assumption boundaries.
Safety · Dominant path
Device-control safety
Compromise of a head-worn MR display with cameras and live spatial mapping reduces safety margin and can influence what the wearer perceives as real (mid-use).
Proximity or local access
Wi-Fi radio proximity, unauthenticated, no association or victim physical access (adjacent radio range).
EvidenceNVD
Cross-domain authority chain
Driver and kernel compromise crosses radio to device to perception and safety boundaries and is a reusable bridge.
EvidenceNo direct citation — inspect the declared inference or assumption.
Credible safety consequence
Compromise of a head-worn MR display with cameras and live spatial mapping reduces safety margin and can influence what the wearer perceives as real (mid-use).
EvidenceNo direct citation — inspect the declared inference or assumption.
Device-control safety
Compromise of a head-worn MR display with cameras and live spatial mapping reduces safety margin and can influence what the wearer perceives as real (mid-use).
EvidenceNo direct citation — inspect the declared inference or assumption.
Coordinated operational recovery
Recovery requires installing the vendor update on each affected headset and validating normal wireless operation.
EvidenceNo direct citation — inspect the declared inference or assumption.
Decision rationale
Why this band?
The compact score is separated into the facts and judgments that produced it.
Reach and effort
- Reachability
RE 2 - Proximity or local access
Wi-Fi radio proximity, unauthenticated, no association or victim physical access (adjacent radio range).
- Execution complexity
EC 1 - Narrow or timing-dependent technique
Reliable heap-overflow remote code execution is exploit-dependent, fragile and timing-sensitive (denial of service is easy, code execution is hard).
- Exposure
EX 1 - Execution effort limits exposure
The interface is broadly reachable, but the required technique keeps practical exposure below that reach.
Consequence
- Physical / safety
PH 3 - Credible safety consequence
Compromise of a head-worn MR display with cameras and live spatial mapping reduces safety margin and can influence what the wearer perceives as real (mid-use).
- Data / perception
DP 4 - Safety-driving perception or intimate data
Code execution exposes camera and spatial-map and live-sensor world-model state and can affect rendered-environment integrity.
- Authority
AT 3 - Administrative or command authority
Native code execution in the wireless driver reaches kernel or service-level device authority, but not the signing or firmware-update root.
Scale and recovery
- Chainability
CH 4 - Cross-domain authority chain
Driver and kernel compromise crosses radio to device to perception and safety boundaries and is a reusable bridge.
- Reuse scale
SR 4 - Shared fleet-wide primitive
The over-the-air exploit can be reused against HoloLens devices that contain the affected Broadcom wireless component.
- Execution scale
SX 2 - Proximity-bound repetition
The code-execution attempt must be made within Wi-Fi range of each target headset rather than through a remote fleet channel.
- Recovery burden
OR 3 - Coordinated operational recovery
Recovery requires installing the vendor update on each affected headset and validating normal wireless operation.
Confidence and status
- Evidence strength
EV 2 - Public report, not reproduced here
NVD reports the condition, but this registry has not independently reproduced this path.
- Liveness
LS Patch available - A patch is available
A vendor fix is available, while deployment and upgrade completion remain separate operational questions.
Decision trail
How the final band follows
- Base bandCRITICAL
- No adjustment
The CRITICAL base band remains final because no separate cap or systemic uplift applies. Compromise of a head-worn MR display with cameras and live spatial mapping reduces safety margin and can influence what the wearer perceives as real (mid-use).
- Final candidate bandCRITICAL
Technical vector
CPATH:1.0-candidate/TT:DEVICE_CONTROL_SAFETY/RE:2/EC:1/EX:1/PH:3/DP:4/AT:3/CH:4/SR:4/SX:2/OR:3/EV:2/LS:PATCH_AVAILABLERead the scoring method →Recovery · Supporting path
Device availability and recovery
Crashing the head-worn display interrupts the wearer’s live workflow and visual overlay, but does not itself create persistent harm or dangerous actuation.
One cross-boundary bridge
Crosses radio to device boundary but is not a reusable cross-domain authority bridge on its own.
EvidenceNo direct citation — inspect the declared inference or assumption.
Operational safety effect
Crashing the head-worn display interrupts the wearer’s live workflow and visual overlay, but does not itself create persistent harm or dangerous actuation.
EvidenceNo direct citation — inspect the declared inference or assumption.
Device availability and recovery
Crashing the head-worn display interrupts the wearer’s live workflow and visual overlay, but does not itself create persistent harm or dangerous actuation.
EvidenceNo direct citation — inspect the declared inference or assumption.
Patch, reset, or reconfiguration
Device reboots and recovers.
EvidenceNo direct citation — inspect the declared inference or assumption.
Decision rationale
Why this band?
The compact score is separated into the facts and judgments that produced it.
Reach and effort
- Reachability
RE 2 - Proximity or local access
Wi-Fi proximity, unauthenticated, no physical access.
- Execution complexity
EC 4 - Straightforward operation
Crafted Wi-Fi frames can reliably interrupt service with one short exchange; this path does not require the harder code-execution chain.
- Exposure
EX 2 - Access position limits exposure
The technique is easier to perform than it is to position against a target, so access is the constraining factor.
Consequence
- Physical / safety
PH 2 - Operational safety effect
Crashing the head-worn display interrupts the wearer’s live workflow and visual overlay, but does not itself create persistent harm or dangerous actuation.
- Data / perception
DP 0 - No data consequence
The availability path disrupts headset operation without independently exposing sensitive user data.
- Authority
AT 2 - Bounded function authority
Bounded availability impact of the device and component, no authority gain.
Scale and recovery
- Chainability
CH 2 - One cross-boundary bridge
Crosses radio to device boundary but is not a reusable cross-domain authority bridge on its own.
- Reuse scale
SR 4 - Shared fleet-wide primitive
Identical frame payload reusable against any affected Broadcom-driver unit (shared component).
- Execution scale
SX 2 - Proximity-bound repetition
The attacker must be within Wi-Fi radio range of each HoloLens, so interruption remains one nearby device at a time.
- Recovery burden
OR 2 - Patch, reset, or reconfiguration
Device reboots and recovers.
Confidence and status
- Evidence strength
EV 2 - Public report, not reproduced here
NVD reports the condition, but this registry has not independently reproduced this path.
- Liveness
LS Patch available - A patch is available
A vendor fix is available, while deployment and upgrade completion remain separate operational questions.
Decision trail
How the final band follows
- Base bandHIGH
- No adjustment
The HIGH base band remains final because no separate cap or systemic uplift applies. Crashing the head-worn display interrupts the wearer’s live workflow and visual overlay, but does not itself create persistent harm or dangerous actuation.
- Final candidate bandHIGH
Technical vector
CPATH:1.0-candidate/TT:DEVICE_AVAILABILITY/RE:2/EC:4/EX:2/PH:2/DP:0/AT:2/CH:2/SR:4/SX:2/OR:2/EV:2/LS:PATCH_AVAILABLERead the scoring method →Triage implication
Verify the safety transition before acting on the band.
Validate the deployment-specific transition from digital control or perception to physical action before setting remediation urgency.
Evidence ledger
Public sources used by this record.
Every named source includes a public link. Path review remains separate from citation coverage.
Published baseline
Keep exploit severity and consequence reasoning distinct.
CVSS:3.1/AV:A/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:HCVSS:3.1/AV:A/AC:H/PR:N/UI:R/S:C/C:H/I:H/A:HCVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:HCVSS:3.1/AV:A/AC:H/PR:N/UI:R/S:C/C:H/I:H/A:HCVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:HCVSS:3.1/AV:A/AC:H/PR:N/UI:R/S:C/C:H/I:H/A:HCVSS:3.1/AV:A/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:HCVSS:3.1/AV:A/AC:H/PR:N/UI:R/S:C/C:H/I:H/A:HCVE recordsCVE-2019-9500CVE-2019-9501CVE-2019-9502CVE-2019-9503
Original scorer notes
The source narrative behind the structured explanation.
Retained for provenance and historical review, not as the recommended way to understand the assessment.
Read the original scorer notes
Assessment
CFSE Consequence Paths assesses HoloLens Broadcom Wi-Fi over-the-air RCE/DoS (ADV190017: CVE-2019-9501/9503) at CRITICAL — the worst of 2 risk paths (safety). The dominant consequence is influence over a safety-relevant actuation.
Vulnerability
HoloLens Broadcom Wi-Fi over-the-air RCE/DoS (ADV190017: CVE-2019-9501/9503). Reported attack vector: ADJACENT_NETWORK (Wi-Fi radio proximity, unauthenticated).
CFSE Consequence Paths analysis
The vulnerability is decomposed into one risk path per terminal consequence. Each path is scored on its exposure (reachability × execution complexity) and the authority, perception, and physical/safety it reaches, together with its scale of reuse, scale of execution, and recoverability.
DEVICE_CONTROL_SAFETY → CRITICAL
CPATH:1.0-candidate/TT:DEVICE_CONTROL_SAFETY/RE:2/EC:1/EX:1/PH:3/DP:4/AT:3/CH:4/SR:4/SX:2/OR:3/EV:2/LS:PATCH_AVAILABLE
Exposure EX=1 (execution complexity-bound) · bands PH=HIGH · DP=CRITICAL · AT=HIGH → base CRITICAL · caps low-exposure cap → assessed CRITICAL.
- RE2 — Wi-Fi radio proximity, unauthenticated, no association or victim physical access (ADJACENT).
- EC1 — reliable heap-overflow RCE is exploit-dependent, fragile/timing-sensitive (DoS is easy, code exec is hard).
- AT3 — native code at wireless-driver/kernel level = device compromise / service-level authority, but not a signing/OTA/identity root, so not 4.
- PH3 — compromise of a head-worn MR display with cameras and live spatial mapping reduces safety margin and can influence what the wearer perceives as real (mid-use); credible injury (PH4) not demonstrated.
- DP4 — code execution exposes camera/spatial-map/live-sensor world-model state and can affect rendered-environment integrity.
- perception_feeds_action — true: the headset’s camera/spatial map drives the wearer’s perception of safety-relevant reality and AR rendering.
- CH4 — boundary_crossing true: driver/kernel compromise crosses radio->device->perception/safety boundaries and is a reusable bridge.
- SR4 — same Broadcom driver/payload reused across many affected units (shared-component supply-chain reuse).
- SX2 — per-device proximity required (range-limited per attacker, one nearby unit at a time).
- OR3 — requires firmware/driver update push to detect/recover; not a full recall or signing-root rotation.
- EV2 — report-backed advisory, no field exploitation observed.
- active_exploitation — false.
DEVICE_AVAILABILITY → HIGH
CPATH:1.0-candidate/TT:DEVICE_AVAILABILITY/RE:2/EC:4/EX:2/PH:3/DP:0/AT:2/CH:2/SR:4/SX:2/OR:2/EV:2/LS:PATCH_AVAILABLE
Exposure EX=2 (reachability-bound) · bands PH=HIGH · DP=MONITOR · AT=ELEVATED → base HIGH → assessed HIGH.
- DoS branch (CVSS A:H).
- RE2 — Wi-Fi proximity, unauthenticated, no physical access.
- EC4 — DoS via crafted frames is trivial/single-request and reliable (explicitly stated as trivial).
- PH2 — a crash mid-use disrupts the wearer / workflow availability disruption without severe harm.
- DP0 — pure crash, no data exposure on this path.
- AT2 — bounded availability impact of the device/component, no authority gain.
- CH2 — boundary_crossing true: crosses radio->device boundary but is not a reusable cross-domain authority bridge on its own.
- SR4 — identical frame payload reusable against any affected Broadcom-driver unit (shared component).
- SX2 — per-device proximity, range-limited per attacker.
- OR2 — device reboots/recovers; firmware update needed to prevent recurrence but no fleet reprovision.
- EV2 — report-backed.
- active_exploitation — false.
Published baseline
- v3.1 8.3 HIGH —
CVSS:3.1/AV:A/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:H— NVD (CVE-2019-9500) - v3.1 7.9 HIGH —
CVSS:3.1/AV:A/AC:H/PR:N/UI:R/S:C/C:H/I:H/A:H— CERT/CC via NVD (CVE-2019-9500) - v3.1 8.8 HIGH —
CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H— NVD (CVE-2019-9501) - v3.1 7.9 HIGH —
CVSS:3.1/AV:A/AC:H/PR:N/UI:R/S:C/C:H/I:H/A:H— CERT/CC via NVD (CVE-2019-9501) - v3.1 8.8 HIGH —
CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H— NVD (CVE-2019-9502) - v3.1 7.9 HIGH —
CVSS:3.1/AV:A/AC:H/PR:N/UI:R/S:C/C:H/I:H/A:H— CERT/CC via NVD (CVE-2019-9502) - v3.1 8.3 HIGH —
CVSS:3.1/AV:A/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:H— NVD (CVE-2019-9503) - v3.1 7.9 HIGH —
CVSS:3.1/AV:A/AC:H/PR:N/UI:R/S:C/C:H/I:H/A:H— CERT/CC via NVD (CVE-2019-9503)
The published baseline above is retained for source review. The registry records the reachable consequence path, including deployment-specific cyber-physical consequence, physical/safety impact, scale, and recovery burden.
Sources
CFSE Consequence Paths Registry 1.0-candidate, CPATH-2026-0014 (“HoloLens Broadcom Wi-Fi over-the-air RCE/DoS (ADV190017: CVE-2019-9501/9503)”), paths.cfse.ai/CPATH-2026-0014 (published 2026-06-03).