CVE-2020-26142
At a glance
- Source
- NVD
- EPSS
- EPSS 2.08 % · percentile 81 ()
- State
- PUBLISHED
- Published
- Updated
- Assigner
- mitre
- NVD status
- Modified
Description
An issue was discovered in the kernel in OpenBSD 6.6. The WEP, WPA, WPA2, and WPA3 implementations treat fragmented frames as full frames. An adversary can abuse this to inject arbitrary network packets, independent of the network configuration.
Weaknesses (CWE)
- CWE-74 — Improper Neutralization of Special Elements in Output Used by a Downstream Component
References
- https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-wifi-faf-22epcEWu
- https://www.fragattacks.com
- https://github.com/vanhoefm/fragattacks/blob/master/SUMMARY.md
- http://www.openwall.com/lists/oss-security/2021/05/11/12
- https://www.arista.com/en/support/advisories-notices/security-advisories/12602-security-advisory-63
Scores
| Version | Score | Vector | Scored by |
|---|---|---|---|
| CVSS 3.1 | MEDIUM 5.3 | CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:N/I:H/A:N | NVD · nvd@nist.gov (Primary) |
| CVSS 2.0 | LOW 2.6 | AV:N/AC:H/Au:N/C:N/I:P/A:N | NVD · nvd@nist.gov (Primary) |
European references
- ENISA EUVD · EUVD-2020-18769
- GCVE · GCVE-0-2020-26142
CERT-FR advisories
- CERTFR-2026-AVI-0326 — Multiples vulnérabilités dans les produits VMware · cert.ssi.gouv.fr
- CERTFR-2026-AVI-0316 — Multiples vulnérabilités dans les produits VMware · cert.ssi.gouv.fr
- CERTFR-2022-AVI-706 — Multiples vulnérabilités dans les produits Belden · cert.ssi.gouv.fr
- CERTFR-2022-AVI-601 — Multiples vulnérabilités dans Belden ProSoft RadioLinx RLX2 · cert.ssi.gouv.fr
Affected configurations (NVD CPE)
cpe:2.3:o:openbsd:openbsd:6.6:*:*:*:*:*:*:*
Affected products
| Product | Versions |
|---|---|
| affected n/a |
Sources
| Source | Licence |
|---|---|
| CVE List (CVEProject cvelistV5) | CVE Program Terms of Use |
| EPSS (FIRST.org) | FIRST — attribution requested |
| ENISA EUVD | ENISA — reproduction authorised, source acknowledged |
| CERT-FR (ANSSI) | Licence Ouverte / Etalab 2.0 |
| NVD (NIST) via fkie-cad/nvd-json-data-feeds | Public domain — this product uses data from the NVD API but is not endorsed or certified by the NVD |