VulnerabilityModified
CVE-2020-26144
An adversary can abuse this to inject arbitrary network packets independent of the network configuration.
MEDIUM 6.5EPSS 4.91%
Does this matter?
Lower severity and a low EPSS score (4.91%). Track it; it rarely justifies an emergency change on its own.
Description
An issue was discovered on Samsung Galaxy S3 i9305 4.4.4 devices. The WEP, WPA, WPA2, and WPA3 implementations accept plaintext A-MSDU frames as long as the first 8 bytes correspond to a valid RFC1042 (i.e., LLC/SNAP) header for EAPOL. An adversary can abuse this to inject arbitrary network packets independent of the network configuration.
- CVSS 3.1
- 6.5 MEDIUMCVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N
- EPSS
- 4.91% probability · 92th percentile
- CISA KEV
- Not listed
- Weakness
- CWE-20
- Affected
- samsung/galaxy i9305 firmware · arista/c-250 firmware · arista/c-260 firmware · arista/c-230 firmware · arista/c-235 firmware · arista/c-200 firmware · arista/c-120 firmware · arista/c-130 firmware · arista/c-100 firmware · arista/c-110 firmware · arista/o-105 firmware · arista/w-118 firmware · arista/c-75 firmware · arista/o-90 firmware · arista/c-65 firmware · arista/w-68 firmware · siemens/scalance w700 ieee 802.11ax firmware · siemens/scalance w700 ieee 802.11n firmware
- Source
- cve@mitre.org
References
- http://www.openwall.com/lists/oss-security/2021/05/11/12Mailing List, Third Party Advisory
- https://cert-portal.siemens.com/productcert/pdf/ssa-913875.pdfThird Party Advisory
- https://github.com/vanhoefm/fragattacks/blob/master/SUMMARY.mdThird Party Advisory
- https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-wifi-faf-22epcEWuThird Party Advisory
- https://www.arista.com/en/support/advisories-notices/security-advisories/12602-security-advisory-63Third Party Advisory
- https://www.fragattacks.comThird Party Advisory
- http://www.openwall.com/lists/oss-security/2021/05/11/12Mailing List, Third Party Advisory
- https://cert-portal.siemens.com/productcert/pdf/ssa-913875.pdfThird Party Advisory
- https://github.com/vanhoefm/fragattacks/blob/master/SUMMARY.mdThird Party Advisory
- https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-wifi-faf-22epcEWuThird Party Advisory
- https://www.arista.com/en/support/advisories-notices/security-advisories/12602-security-advisory-63Third Party Advisory
- https://www.fragattacks.comThird Party Advisory
- https://cert-portal.siemens.com/productcert/html/ssa-019200.html
- https://cert-portal.siemens.com/productcert/html/ssa-913875.html
Source: NVD record, EPSS from FIRST.org, KEV from CISA. Refreshed daily.