Full Report
Twelve vulnerabilities in the implementation of frame aggregation and fragmentation of the 802.11 standard, under the name of FragAttacks, have been published. Successful exploitation of these vulnerabilities could allow an attacker within Wi-Fi range to forge encrypted frames, which could result in sensitive data disclosure and possibly traffic manipulation. The advised Siemens products are only affected by some of the published vulnerabilities. Siemens has released updates for several affected products and recommends to update to the latest versions. Siemens recommends specific countermeasures for products where updates are not, or not yet available.
Analysis Summary
# Vulnerability: FragAttacks (802.11 Design and Implementation Flaws)
## CVE Details
*Note: FragAttacks encompasses 12 CVEs; Siemens products are specifically impacted by a subset of these.*
- **CVE ID:** CVE-2020-24586, CVE-2020-24587, CVE-2020-24588 (Design flaws); CVE-2020-26139, CVE-2020-26140, CVE-2020-26141, CVE-2020-26142, CVE-2020-26143, CVE-2020-26144, CVE-2020-26145, CVE-2020-26146, CVE-2020-26147 (Implementation flaws).
- **CVSS Score:** Range 4.8 to 6.5 (Medium)
- **CWE:** CWE-20 (Improper Input Validation), CWE-345 (Insufficient Verification of Data Authenticity)
## Affected Systems
- **Products:** Various Siemens industrial and networking products including SCALANCE W, RUGGEDCOM Wi-Fi devices, and SIMATIC industrial PCs with Wi-Fi modules.
- **Versions:** Multiple versions are affected depending on the specific product line.
- **Configurations:** Devices with Wi-Fi (802.11) functionality enabled and utilizing WPA2 or WPA3 encryption.
## Vulnerability Description
FragAttacks (Fragmentation and Aggregation Attacks) refer to flaws in the IEEE 802.11 Wi-Fi standard. The vulnerabilities are split into two categories:
1. **Design Flaws:** Issues in the 802.11 standard itself regarding how it handles the aggregation and fragmentation of frames. For example, the receiver does not sufficiently check if all fragments were encrypted using the same key.
2. **Implementation Flaws:** Errors in how specific vendors implemented the Wi-Fi stack, leading to vulnerabilities like the trivial injection of unencrypted frames or the processing of fragments as full frames.
## Exploitation
- **Status:** PoC available (research-led disclosure).
- **Complexity:** Medium to High (requires precise timing and frame injection).
- **Attack Vector:** Adjacent (Attacker must be within physical Wi-Fi range of the target).
## Impact
- **Confidentiality:** Medium (Potential sensitive data disclosure/interception).
- **Integrity:** Medium (Possible traffic manipulation and forging of encrypted frames).
- **Availability:** Low (Possible localized disruption of Wi-Fi services).
## Remediation
### Patches
- Siemens has released firmware updates for several affected product families (e.g., SCALANCE, RUGGEDCOM).
- **Action:** Users should consult the specific Siemens Security Advisory (SSA-915880) to identify the correct firmware version for their hardware.
### Workarounds
If patches are not yet available:
- Disable Wi-Fi functionality if not strictly required.
- Use higher-layer encryption (e.g., VPN, HTTPS, SSH) to protect data even if the Wi-Fi layer is compromised.
- Implement strict access control to the physical perimeter to prevent unauthorized individuals from being within Wi-Fi range.
## Detection
- **Indicators of Compromise:** Unusual patterns of fragmented Wi-Fi frames or unexpected de-authentication packets.
- **Detection methods and tools:** Specialized wireless Intrusion Detection Systems (wIDS) can be configured to alert on anomalous frame fragmentation/aggregation behaviors.
## References
- **Siemens Advisory:** hxxps[://]cert-portal[.]siemens[.]com/productcert/pdf/ssa-915880[.]pdf
- **FragAttacks Technical Research:** hxxps[://]www[.]fragattacks[.]com/
- **CERT/CC:** hxxps[://]www[.]kb[.]cert[.]org/vuls/id/727683