CVE-2020-24586
- State
- Published
- Severity
- Not scored
- Published
- May 11, 2021
- Updated
- Aug 4, 2024
- Reserved
- Aug 21, 2020
Description
The 802.11 standard that underpins Wi-Fi Protected Access (WPA, WPA2, and WPA3) and Wired Equivalent Privacy (WEP) doesn't require that received fragments be cleared from memory after (re)connecting to a network. Under the right circumstances, when another device sends fragmented frames encrypted using WEP, CCMP, or GCMP, this can be abused to inject arbitrary network packets and/or exfiltrate user data.
Scores
The record has no CVSS score.
Weaknesses
The record names no weakness.
Affected Products
| Product | Versions |
|---|---|
n/an/a |
|
References
- https://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-00473.html
- 20210511 Multiple Vulnerabilities in Frame Aggregation and Fragmentation Implementations of 802.11 Specification Affecting Cisco Products: May 2021vendor-advisory
- https://www.fragattacks.com/
- https://github.com/vanhoefm/fragattacks/blob/master/SUMMARY.md
- [oss-security] 20210511 various 802.11 security issues - fragattacks.commailing-list
- [debian-lts-announce] 20210623 [SECURITY] [DLA 2689-1] linux security updatemailing-list
- [debian-lts-announce] 20210623 [SECURITY] [DLA 2690-1] linux-4.19 security updatemailing-list
- https://www.arista.com/en/support/advisories-notices/security-advisories/12602-security-advisory-63
- [debian-lts-announce] 20230401 [SECURITY] [DLA 3380-1] firmware-nonfree LTS new upstream version (security updates and newer firmware for Linux 5.10)mailing-list
Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.