Search vulnerabilities

Use the Query Builder to create your own search query, or check out the documentation to learn the search syntax.

Results 7

Export CSV
CVE-2020-26144

kernel: accepting unencrypted A-MSDU frames that start with RFC1042 header

An issue was discovered on Samsung Galaxy S3 i9305 4.4.4 devices. The WEP, WPA, WPA2, and WPA3 implementations accept plaintext A-MSDU frames as long as the first 8 bytes correspond to a valid RFC1042 (i.e., LLC/SNAP) header for EAPOL. An adversary can abuse this to inject arbitrary network packets independent of the network configuration.

CVSS 3.1 · 6.5 Medium EPSS 4.9% KEV · Not listed
Vendors
Arista Redhat Samsung and 1 more
Products
C-100 C-100 Firmware C-110 and 34 more
CVE-2020-26140

kernel: accepting plaintext data frames in protected networks

An issue was discovered in the ALFA Windows 10 driver 6.1316.1209 for AWUS036H. The WEP, WPA, WPA2, and WPA3 implementations accept plaintext frames in a protected Wi-Fi network. An adversary can abuse this to inject arbitrary data frames independent of the network configuration.

CVSS 3.1 · 6.5 Medium EPSS 2.9% KEV · Not listed
Vendors
Alfa Arista Cisco and 3 more
Products
Awus036h Awus036h Firmware C-100 and 386 more
CVE-2020-26146

kernel: reassembling encrypted fragments with non-consecutive packet numbers

An issue was discovered on Samsung Galaxy S3 i9305 4.4.4 devices. The WPA, WPA2, and WPA3 implementations reassemble fragments with non-consecutive packet numbers. An adversary can abuse this to exfiltrate selected fragments. This vulnerability is exploitable when another device sends fragmented frames and the WEP, CCMP, or GCMP data-confidentiality protocol is used. Note that WEP is vulnerable to this attack by design.

CVSS 3.1 · 5.3 Medium EPSS 5.6% KEV · Not listed
Vendors
Arista Redhat Samsung and 1 more
Products
C-100 C-100 Firmware C-110 and 36 more
CVE-2020-26139

kernel: Forwarding EAPOL from unauthenticated wifi client

An issue was discovered in the kernel in NetBSD 7.1. An Access Point (AP) forwards EAPOL frames to other clients even though the sender has not yet successfully authenticated to the AP. This might be abused in projected Wi-Fi networks to launch denial-of-service attacks against connected clients and makes it easier to exploit other vulnerabilities in connected clients.

CVSS 3.1 · 5.3 Medium EPSS 6.5% KEV · Not listed
Vendors
Arista Cisco Debian and 3 more
Products
C-100 C-100 Firmware C-110 and 328 more
CVE-2020-24588

kernel: wifi frame payload being parsed incorrectly as an L2 frame

The 802.11 standard that underpins Wi-Fi Protected Access (WPA, WPA2, and WPA3) and Wired Equivalent Privacy (WEP) doesn't require that the A-MSDU flag in the plaintext QoS header field is authenticated. Against devices that support receiving non-SSP A-MSDU frames (which is mandatory as part of 802.11n), an adversary can abuse this to inject arbitrary network packets.

CVSS 3.1 · 3.5 Low EPSS 3.6% KEV · Not listed
Vendors
Arista Cisco Debian and 6 more
Products
C-100 C-100 Firmware C-110 and 348 more
CVE-2020-24587

kernel: Reassembling fragments encrypted under different keys

The 802.11 standard that underpins Wi-Fi Protected Access (WPA, WPA2, and WPA3) and Wired Equivalent Privacy (WEP) doesn't require that all fragments of a frame are encrypted under the same key. An adversary can abuse this to decrypt selected fragments when another device sends fragmented frames and the WEP, CCMP, or GCMP encryption key is periodically renewed.

CVSS 3.1 · 2.6 Low EPSS 2.6% KEV · Not listed
Vendors
Arista Cisco Debian and 4 more
Products
C-100 C-100 Firmware C-110 and 330 more
CVE-2020-24586

kernel: Fragmentation cache not cleared on reconnection

The 802.11 standard that underpins Wi-Fi Protected Access (WPA, WPA2, and WPA3) and Wired Equivalent Privacy (WEP) doesn't require that received fragments be cleared from memory after (re)connecting to a network. Under the right circumstances, when another device sends fragmented frames encrypted using WEP, CCMP, or GCMP, this can be abused to inject arbitrary network packets and/or exfiltrate user data.

CVSS 3.1 · 3.5 Low EPSS 5.8% KEV · Not listed
Vendors
Arista Debian Ieee and 3 more
Products
C-200 C-200 Firmware C-230 and 42 more