CVEvulnerability

CVE-2020-26144

6.5 MEDIUM Published 2021-05-11 Modified 2026-10-08 Official page ↗
Status
Modified
Published
2021-05-11
Last modified
2026-10-08
Assigner
[email protected]
CVSS 3.1 ([email protected])
6.5 MEDIUM — CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N
CVSS 2.0 ([email protected])
3.3 LOW — AV:A/AC:L/Au:N/C:N/I:P/A:N
Weaknesses
CWE-20

Description

An issue was discovered on Samsung Galaxy S3 i9305 4.4.4 devices. The WEP, WPA, WPA2, and WPA3 implementations accept plaintext A-MSDU frames as long as the first 8 bytes correspond to a valid RFC1042 (i.e., LLC/SNAP) header for EAPOL. An adversary can abuse this to inject arbitrary network packets independent of the network configuration.

Affected configurations

• samsung galaxy i9305 firmware 4.4.4 • arista c-250 firmware (< 10.0.1-31) • arista c-260 firmware (< 10.0.1-31) • arista c-230 firmware (< 10.0.1-31) • arista c-235 firmware (< 10.0.1-31) • arista c-200 firmware (< 11.0.0-36) • arista c-120 firmware (< 11.0.0-36) • arista c-130 firmware (< 11.0.0-36) • arista c-100 firmware (< 11.0.0-36) • arista c-110 firmware (< 11.0.0-36) • arista o-105 firmware (< 11.0.0-36) • arista w-118 firmware (< 11.0.0-36) • arista c-75 firmware • arista o-90 firmware • arista c-65 firmware • arista w-68 firmware • siemens scalance w700 ieee 802.11ax firmware • siemens scalance w700 ieee 802.11n firmware

Related

Weakness · CWE (1)

  • CWE-20 Improper Input Validation weakness

References