CVE-2020-26145

MediumCVSS 6.5/10Last modified Jun 17, 2026

Description

An issue was discovered on Samsung Galaxy S3 i9305 4.4.4 devices. The WEP, WPA, WPA2, and WPA3 implementations accept second (or subsequent) broadcast fragments even when sent in plaintext and process them as full unfragmented frames. An adversary can abuse this to inject arbitrary network packets independent of the network configuration.

Metrics

CVSS 3.1 6.5/10CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N

Weakness enumeration

CWE-20

Affected software

Vendor	Product	Versions
n/a	n/a	n/a
Siemens	SCALANCE WAM763-1	< V1.2.0
Siemens	SCALANCE WAM766-1	< V1.2.0
Siemens	SCALANCE WAM766-1 (US)	< V1.2.0
Siemens	SCALANCE WAM766-1 EEC	< V1.2.0
Siemens	SCALANCE WAM766-1 EEC (US)	< V1.2.0
Siemens	SCALANCE WUM763-1	< V1.2.0
Siemens	SCALANCE WUM763-1	< V1.2.0
Siemens	SCALANCE WUM766-1	< V1.2.0
Siemens	SCALANCE WUM766-1 (USA)	< V1.2.0

References

http://www.openwall.com/lists/oss-security/2021/05/11/12Mailing List, Third Party Advisory
https://cert-portal.siemens.com/productcert/pdf/ssa-913875.pdfPatch, Third Party Advisory
https://github.com/vanhoefm/fragattacks/blob/master/SUMMARY.mdThird Party Advisory
https://www.fragattacks.comThird Party Advisory
http://www.openwall.com/lists/oss-security/2021/05/11/12Mailing List, Third Party Advisory
https://cert-portal.siemens.com/productcert/pdf/ssa-913875.pdfPatch, Third Party Advisory
https://github.com/vanhoefm/fragattacks/blob/master/SUMMARY.mdThird Party Advisory
https://www.fragattacks.comThird Party Advisory
https://cert-portal.siemens.com/productcert/html/ssa-913875.html

Timeline

Published: May 11, 2021
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2020

CVE-2020-261465.3An issue was discovered on Samsung Galaxy S3 i9305 4.4.4 devices. The WPA, WPA2, and WPA3 implementations reassemble fragments with non-cons CVE-2020-261475.4An issue was discovered in the Linux kernel 5.8.9. The WEP, WPA, WPA2, and WPA3 implementations reassemble fragments even though some of the CVE-2020-261487.5md_push_block_bytes in md4c.c in md4c 0.4.5 allows attackers to trigger use of uninitialized memory, and cause a denial of service (e.g., as CVE-2020-261497.5NATS nats.js before 2.0.0-209, nats.ws before 1.0.0-111, and nats.deno before 1.0.0-9 allow credential disclosure from a client to a server.CVE-2020-26156.0Vulnerability in the Enterprise Manager Base Platform product of Oracle Enterprise Manager (component: Oracle Management Service). Supported CVE-2020-261507.5info.php in Logaritmo Aware CallManager 2012 allows remote attackers to obtain sensitive information via a direct request, which calls the p CVE-2020-261536.1A cross-site scripting (XSS) vulnerability in wp-content/plugins/event-espresso-core-reg/admin_pages/messages/templates/ee_msg_admin_overvie CVE-2020-261549.8url.cpp in libproxy through 0.4.15 is prone to a buffer overflow when PAC is enabled, as demonstrated by a large PAC file that is delivered CVE-2020-261557.8Multiple files and folders in Utimaco SecurityServer 4.20.0.4 and 4.31.1.0. are installed with Read/Write permissions for authenticated user CVE-2020-261579.6Leanote Desktop through 2.6.2 allows XSS because a note's title is mishandled during syncing. This leads to remote code execution because of CVE-2020-261589.6Leanote Desktop through 2.6.2 allows XSS because a note's title is mishandled when the batch feature is triggered. This leads to remote code CVE-2020-26166.0Vulnerability in the Enterprise Manager Base Platform product of Oracle Enterprise Manager (component: Enterprise Manager Repository). Suppo