Search vulnerabilities

Use the Query Builder to create your own search query, or check out the documentation to learn the search syntax.

Results 5

Export CSV
CVE-2020-26140

kernel: accepting plaintext data frames in protected networks

An issue was discovered in the ALFA Windows 10 driver 6.1316.1209 for AWUS036H. The WEP, WPA, WPA2, and WPA3 implementations accept plaintext frames in a protected Wi-Fi network. An adversary can abuse this to inject arbitrary data frames independent of the network configuration.

CVSS 3.1 · 6.5 Medium EPSS 2.9% KEV · Not listed
Vendors
Alfa Arista Cisco and 3 more
Products
Awus036h Awus036h Firmware C-100 and 386 more
CVE-2020-26139

kernel: Forwarding EAPOL from unauthenticated wifi client

An issue was discovered in the kernel in NetBSD 7.1. An Access Point (AP) forwards EAPOL frames to other clients even though the sender has not yet successfully authenticated to the AP. This might be abused in projected Wi-Fi networks to launch denial-of-service attacks against connected clients and makes it easier to exploit other vulnerabilities in connected clients.

CVSS 3.1 · 5.3 Medium EPSS 6.5% KEV · Not listed
Vendors
Arista Cisco Debian and 3 more
Products
C-100 C-100 Firmware C-110 and 328 more
CVE-2020-24588

kernel: wifi frame payload being parsed incorrectly as an L2 frame

The 802.11 standard that underpins Wi-Fi Protected Access (WPA, WPA2, and WPA3) and Wired Equivalent Privacy (WEP) doesn't require that the A-MSDU flag in the plaintext QoS header field is authenticated. Against devices that support receiving non-SSP A-MSDU frames (which is mandatory as part of 802.11n), an adversary can abuse this to inject arbitrary network packets.

CVSS 3.1 · 3.5 Low EPSS 3.6% KEV · Not listed
Vendors
Arista Cisco Debian and 6 more
Products
C-100 C-100 Firmware C-110 and 348 more
CVE-2022-20695

Cisco Wireless LAN Controller Management Interface Authentication Bypass Vulnerability

A vulnerability in the authentication functionality of Cisco Wireless LAN Controller (WLC) Software could allow an unauthenticated, remote attacker to bypass authentication controls and log in to the device through the management interface This vulnerability is due to the improper implementation of the password validation algorithm. An attacker could exploit this vulnerability by logging in to an affected device with crafted credentials. A successful exploit could allow the attacker to bypass authentication and log in to the device as an administrator. The attacker could obtain privileges that are the same level as an administrative user but it depends on the crafted credentials. Note: This vulnerability exists because of a non-default device configuration that must be present for it to be exploitable. For details about the vulnerable configuration, see the Vulnerable Products section of this advisory.

CVSS 3.1 · 10 Critical EPSS 19.8% KEV · Not listed
Vendors
Cisco
Products
3504 Wireless Controller 5520 Wireless Controller 8540 Wireless Controller and 31 more
CVE-2020-24587

kernel: Reassembling fragments encrypted under different keys

The 802.11 standard that underpins Wi-Fi Protected Access (WPA, WPA2, and WPA3) and Wired Equivalent Privacy (WEP) doesn't require that all fragments of a frame are encrypted under the same key. An adversary can abuse this to decrypt selected fragments when another device sends fragmented frames and the WEP, CCMP, or GCMP encryption key is periodically renewed.

CVSS 3.1 · 2.6 Low EPSS 2.6% KEV · Not listed
Vendors
Arista Cisco Debian and 4 more
Products
C-100 C-100 Firmware C-110 and 330 more