IM
IronMonkey Threat Research

CVE-2020-26144 MEDIUM

Published: 2021-05-11 | Last Modified: 2026-04-14 | Status: Modified

Description

An issue was discovered on Samsung Galaxy S3 i9305 4.4.4 devices. The WEP, WPA, WPA2, and WPA3 implementations accept plaintext A-MSDU frames as long as the first 8 bytes correspond to a valid RFC1042 (i.e., LLC/SNAP) header for EAPOL. An adversary can abuse this to inject arbitrary network packets independent of the network configuration.

Additional Descriptions (1)

Se detectó un problema en los dispositivos Samsung Galaxy S3 i9305 versión 4.4.4. Las implementaciones WEP, WPA, WPA2 y WPA3 aceptan tramas A-MSDU de texto plano siempre que los primeros 8 bytes correspondan a un encabezado RFC1042 válido (es decir, LLC/SNAP) para EAPOL. Un adversario puede abusar de esto para inyectar paquetes de red arbitrarios independientemente de la configuración de la red

CVSS Metrics

Base Score: 6.5 (MEDIUM)

CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N

Attack VectorADJACENT_NETWORK
Attack ComplexityLOW
Privileges RequiredNONE
User InteractionNONE
ScopeUNCHANGED
Confidentiality ImpactNONE
Integrity ImpactHIGH
Availability ImpactNONE

Source: [email protected]

Type: Primary

Exploitability Score: 2.8

Impact Score: 3.6

Base Score: 3.3 (LOW)

AV:A/AC:L/Au:N/C:N/I:P/A:N

Access VectorADJACENT_NETWORK
Access ComplexityLOW
AuthenticationNONE
Confidentiality ImpactNONE
Integrity ImpactPARTIAL
Availability ImpactNONE

Source: [email protected]

Type: Primary

Exploitability Score: 6.5

Impact Score: 2.9

Weaknesses

Source Type Description
[email protected] Primary
en CWE-20

Affected Products

Vendor Product Version Update Type
samsung galaxy_i9305_firmware 4.4.4 <built-in method update of dict object at 0x72a9cc625680> Operating System
arista c-250_firmware * <built-in method update of dict object at 0x72a9b0db7040> Operating System
arista c-260_firmware * <built-in method update of dict object at 0x72a9b0db5d40> Operating System
arista c-230_firmware * <built-in method update of dict object at 0x72a9cc627300> Operating System
arista c-235_firmware * <built-in method update of dict object at 0x72a9cc624280> Operating System
arista c-200_firmware * <built-in method update of dict object at 0x72a9cc6244c0> Operating System
arista c-120_firmware * <built-in method update of dict object at 0x72a9b0db5f80> Operating System
arista c-130_firmware * <built-in method update of dict object at 0x72a9cc7ef680> Operating System
arista c-100_firmware * <built-in method update of dict object at 0x72a9b0db4780> Operating System
arista c-110_firmware * <built-in method update of dict object at 0x72a9cc626100> Operating System
arista o-105_firmware * <built-in method update of dict object at 0x72a9b0c990c0> Operating System
arista w-118_firmware * <built-in method update of dict object at 0x72a9b0db5100> Operating System
arista c-75_firmware - <built-in method update of dict object at 0x72a9cc557140> Operating System
arista o-90_firmware - <built-in method update of dict object at 0x72a9b0794c80> Operating System
arista c-65_firmware - <built-in method update of dict object at 0x72a9b0794480> Operating System
arista w-68_firmware - <built-in method update of dict object at 0x72a9b07975c0> Operating System
siemens scalance_w700_ieee_802.11ax_firmware * <built-in method update of dict object at 0x72a9b0c9b440> Operating System
siemens scalance_w700_ieee_802.11n_firmware * <built-in method update of dict object at 0x72a9b0db5800> Operating System

Affected Configurations

Operator: OR

Vulnerable CPE
Yes cpe:2.3:o:samsung:galaxy_i9305_firmware:4.4.4:*:*:*:*:*:*:*

Operator: OR

Vulnerable CPE
No cpe:2.3:h:samsung:galaxy_i9305:-:*:*:*:*:*:*:*

Operator: OR

Vulnerable CPE
Yes cpe:2.3:o:arista:c-250_firmware:*:*:*:*:*:*:*:*

Operator: OR

Vulnerable CPE
No cpe:2.3:h:arista:c-250:-:*:*:*:*:*:*:*

Operator: OR

Vulnerable CPE
Yes cpe:2.3:o:arista:c-260_firmware:*:*:*:*:*:*:*:*

Operator: OR

Vulnerable CPE
No cpe:2.3:h:arista:c-260:-:*:*:*:*:*:*:*

Operator: OR

Vulnerable CPE
Yes cpe:2.3:o:arista:c-230_firmware:*:*:*:*:*:*:*:*

Operator: OR

Vulnerable CPE
No cpe:2.3:h:arista:c-230:-:*:*:*:*:*:*:*

Operator: OR

Vulnerable CPE
Yes cpe:2.3:o:arista:c-235_firmware:*:*:*:*:*:*:*:*

Operator: OR

Vulnerable CPE
No cpe:2.3:h:arista:c-235:-:*:*:*:*:*:*:*

Operator: OR

Vulnerable CPE
Yes cpe:2.3:o:arista:c-200_firmware:*:*:*:*:*:*:*:*

Operator: OR

Vulnerable CPE
No cpe:2.3:h:arista:c-200:-:*:*:*:*:*:*:*

Operator: OR

Vulnerable CPE
Yes cpe:2.3:o:arista:c-120_firmware:*:*:*:*:*:*:*:*

Operator: OR

Vulnerable CPE
No cpe:2.3:h:arista:c-120:-:*:*:*:*:*:*:*

Operator: OR

Vulnerable CPE
Yes cpe:2.3:o:arista:c-130_firmware:*:*:*:*:*:*:*:*

Operator: OR

Vulnerable CPE
No cpe:2.3:h:arista:c-130:-:*:*:*:*:*:*:*

Operator: OR

Vulnerable CPE
Yes cpe:2.3:o:arista:c-100_firmware:*:*:*:*:*:*:*:*

Operator: OR

Vulnerable CPE
No cpe:2.3:h:arista:c-100:-:*:*:*:*:*:*:*

Operator: OR

Vulnerable CPE
Yes cpe:2.3:o:arista:c-110_firmware:*:*:*:*:*:*:*:*

Operator: OR

Vulnerable CPE
No cpe:2.3:h:arista:c-110:-:*:*:*:*:*:*:*

Operator: OR

Vulnerable CPE
Yes cpe:2.3:o:arista:o-105_firmware:*:*:*:*:*:*:*:*

Operator: OR

Vulnerable CPE
No cpe:2.3:h:arista:o-105:-:*:*:*:*:*:*:*

Operator: OR

Vulnerable CPE
Yes cpe:2.3:o:arista:w-118_firmware:*:*:*:*:*:*:*:*

Operator: OR

Vulnerable CPE
No cpe:2.3:h:arista:w-118:-:*:*:*:*:*:*:*

Operator: OR

Vulnerable CPE
Yes cpe:2.3:o:arista:c-75_firmware:-:*:*:*:*:*:*:*

Operator: OR

Vulnerable CPE
No cpe:2.3:h:arista:c-75:-:*:*:*:*:*:*:*

Operator: OR

Vulnerable CPE
Yes cpe:2.3:o:arista:o-90_firmware:-:*:*:*:*:*:*:*

Operator: OR

Vulnerable CPE
No cpe:2.3:h:arista:o-90:-:*:*:*:*:*:*:*

Operator: OR

Vulnerable CPE
Yes cpe:2.3:o:arista:c-65_firmware:-:*:*:*:*:*:*:*

Operator: OR

Vulnerable CPE
No cpe:2.3:h:arista:c-65:-:*:*:*:*:*:*:*

Operator: OR

Vulnerable CPE
Yes cpe:2.3:o:arista:w-68_firmware:-:*:*:*:*:*:*:*

Operator: OR

Vulnerable CPE
No cpe:2.3:h:arista:w-68:-:*:*:*:*:*:*:*

Operator: OR

Vulnerable CPE
Yes cpe:2.3:o:siemens:scalance_w700_ieee_802.11ax_firmware:*:*:*:*:*:*:*:*

Operator: OR

Vulnerable CPE
No cpe:2.3:h:siemens:scalance_w700_ieee_802.11ax:-:*:*:*:*:*:*:*

Operator: OR

Vulnerable CPE
Yes cpe:2.3:o:siemens:scalance_w700_ieee_802.11n_firmware:*:*:*:*:*:*:*:*

Operator: OR

Vulnerable CPE
No cpe:2.3:h:siemens:scalance_w700_ieee_802.11n:-:*:*:*:*:*:*:*

References

Notification
Message here