CVE-2020-26146
This vulnerability is exploitable when another device sends fragmented frames and the WEP, CCMP, or GCMP data-confidentiality protocol is used.
Does this matter?
Lower severity and a low EPSS score (5.62%). Track it; it rarely justifies an emergency change on its own.
Description
An issue was discovered on Samsung Galaxy S3 i9305 4.4.4 devices. The WPA, WPA2, and WPA3 implementations reassemble fragments with non-consecutive packet numbers. An adversary can abuse this to exfiltrate selected fragments. This vulnerability is exploitable when another device sends fragmented frames and the WEP, CCMP, or GCMP data-confidentiality protocol is used. Note that WEP is vulnerable to this attack by design.
- CVSS 3.1
- 5.3 MEDIUMCVSS:3.1/AV:A/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N
- EPSS
- 5.62% probability · 93th percentile
- CISA KEV
- Not listed
- Weakness
- CWE-20
- Affected
- samsung/galaxy i9305 firmware · arista/c-250 firmware · arista/c-260 firmware · arista/c-230 firmware · arista/c-235 firmware · arista/c-200 firmware · arista/c-120 firmware · arista/c-130 firmware · arista/c-100 firmware · arista/c-110 firmware · arista/o-105 firmware · arista/w-118 firmware · arista/c-75 firmware · arista/o-90 firmware · arista/c-65 firmware · arista/w-68 firmware · siemens/scalance w700 ieee 802.11n firmware · siemens/scalance w1700 ieee 802.11ac firmware · siemens/scalance w1750d firmware
- Source
- cve@mitre.org
References
- http://www.openwall.com/lists/oss-security/2021/05/11/12Mailing List, Third Party Advisory
- https://cert-portal.siemens.com/productcert/pdf/ssa-913875.pdfThird Party Advisory
- https://github.com/vanhoefm/fragattacks/blob/master/SUMMARY.mdThird Party Advisory
- https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-wifi-faf-22epcEWuThird Party Advisory
- https://www.arista.com/en/support/advisories-notices/security-advisories/12602-security-advisory-63Third Party Advisory
- https://www.fragattacks.comThird Party Advisory
- http://www.openwall.com/lists/oss-security/2021/05/11/12Mailing List, Third Party Advisory
- https://cert-portal.siemens.com/productcert/pdf/ssa-913875.pdfThird Party Advisory
- https://github.com/vanhoefm/fragattacks/blob/master/SUMMARY.mdThird Party Advisory
- https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-wifi-faf-22epcEWuThird Party Advisory
- https://www.arista.com/en/support/advisories-notices/security-advisories/12602-security-advisory-63Third Party Advisory
- https://www.fragattacks.comThird Party Advisory
- https://cert-portal.siemens.com/productcert/html/ssa-019200.html
- https://cert-portal.siemens.com/productcert/html/ssa-913875.html
Source: NVD record, EPSS from FIRST.org, KEV from CISA. Refreshed daily.