Vulnerability Details CVE-2020-26146
An issue was discovered on Samsung Galaxy S3 i9305 4.4.4 devices. The WPA, WPA2, and WPA3 implementations reassemble fragments with non-consecutive packet numbers. An adversary can abuse this to exfiltrate selected fragments. This vulnerability is exploitable when another device sends fragmented frames and the WEP, CCMP, or GCMP data-confidentiality protocol is used. Note that WEP is vulnerable to this attack by design.
Exploit prediction scoring system (EPSS) score
EPSS Score 0.004
EPSS Ranking 57.9%
CVSS Severity
CVSS v3 Score 5.3
CVSS v2 Score 2.9
References
- http://www.openwall.com/lists/oss-security/2021/05/11/12
- https://cert-portal.siemens.com/productcert/pdf/ssa-913875.pdf
- https://github.com/vanhoefm/fragattacks/blob/master/SUMMARY.md
- https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-wifi-faf-22epcEWu
- https://www.arista.com/en/support/advisories-notices/security-advisories/12602-security-advisory-63
- https://www.fragattacks.com
- http://www.openwall.com/lists/oss-security/2021/05/11/12
- https://cert-portal.siemens.com/productcert/pdf/ssa-913875.pdf
- https://github.com/vanhoefm/fragattacks/blob/master/SUMMARY.md
- https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-wifi-faf-22epcEWu
- https://www.arista.com/en/support/advisories-notices/security-advisories/12602-security-advisory-63
- https://www.fragattacks.com
Products affected by CVE-2020-26146
-
cpe:2.3:h:arista:c-100:-
-
cpe:2.3:h:arista:c-110:-
-
cpe:2.3:h:arista:c-120:-
-
cpe:2.3:h:arista:c-130:-
-
cpe:2.3:h:arista:c-200:-
-
cpe:2.3:h:arista:c-230:-
-
cpe:2.3:h:arista:c-235:-
-
cpe:2.3:h:arista:c-250:-
-
cpe:2.3:h:arista:c-260:-
-
cpe:2.3:h:arista:c-65:-
-
cpe:2.3:h:arista:c-75:-
-
cpe:2.3:h:arista:o-105:-
-
cpe:2.3:h:arista:o-90:-
-
cpe:2.3:h:arista:w-118:-
-
cpe:2.3:h:arista:w-68:-
-
cpe:2.3:h:samsung:galaxy_i9305:-
-
cpe:2.3:h:siemens:scalance_w1700_ieee_802.11ac:-
-
cpe:2.3:h:siemens:scalance_w1750d:-
-
cpe:2.3:h:siemens:scalance_w700_ieee_802.11n:-
-
cpe:2.3:o:arista:c-100_firmware:-
-
cpe:2.3:o:arista:c-110_firmware:-
-
cpe:2.3:o:arista:c-120_firmware:-
-
cpe:2.3:o:arista:c-130_firmware:-
-
cpe:2.3:o:arista:c-200_firmware:-
-
cpe:2.3:o:arista:c-230_firmware:-
-
cpe:2.3:o:arista:c-235_firmware:-
-
cpe:2.3:o:arista:c-250_firmware:-
-
cpe:2.3:o:arista:c-260_firmware:-
-
cpe:2.3:o:arista:c-65_firmware:-
-
cpe:2.3:o:arista:c-75_firmware:-
-
cpe:2.3:o:arista:o-105_firmware:-
-
cpe:2.3:o:arista:o-90_firmware:-
-
cpe:2.3:o:arista:w-118_firmware:-
-
cpe:2.3:o:arista:w-68_firmware:-
-
cpe:2.3:o:samsung:galaxy_i9305_firmware:4.4.4
-
cpe:2.3:o:siemens:scalance_w1700_ieee_802.11ac_firmware:-
-
cpe:2.3:o:siemens:scalance_w1700_ieee_802.11ac_firmware:2.0
-
cpe:2.3:o:siemens:scalance_w1750d_firmware:-
-
cpe:2.3:o:siemens:scalance_w1750d_firmware:6.5.1.5
-
cpe:2.3:o:siemens:scalance_w1750d_firmware:8.3.0.1
-
cpe:2.3:o:siemens:scalance_w1750d_firmware:8.4.0.1
-
cpe:2.3:o:siemens:scalance_w1750d_firmware:8.7.0
-
cpe:2.3:o:siemens:scalance_w700_ieee_802.11n_firmware:-
-
cpe:2.3:o:siemens:scalance_w700_ieee_802.11n_firmware:6.0.1
-
cpe:2.3:o:siemens:scalance_w700_ieee_802.11n_firmware:6.4