CVE-2020-26140 — MEDIUM (6.5)

Vulnerability Description

An issue was discovered in the ALFA Windows 10 driver 6.1316.1209 for AWUS036H. The WEP, WPA, WPA2, and WPA3 implementations accept plaintext frames in a protected Wi-Fi network. An adversary can abuse this to inject arbitrary data frames independent of the network configuration.

CVSS Score

6.5

MEDIUM

CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N

Attack Vector

ADJACENT_NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality

NONE

Integrity

HIGH

Availability

NONE

Affected Products

Vendor	Product	Versions
Alfa	Awus036H Firmware	6.1316.1209
Alfa	Awus036H	-
Siemens	Scalance W1748-1 Firmware	-
Siemens	Scalance W1748-1	-
Siemens	Scalance W1750D Firmware	-
Siemens	Scalance W1750D	-
Siemens	Scalance W1788-1 Firmware	-
Siemens	Scalance W1788-1	-
Siemens	Scalance W1788-2 Firmware	-
Siemens	Scalance W1788-2	-
Siemens	Scalance W1788-2Ia Firmware	-
Siemens	Scalance W1788-2Ia	-
Siemens	Scalance W721-1 Firmware	-
Siemens	Scalance W721-1	-
Siemens	Scalance W722-1 Firmware	-
Siemens	Scalance W722-1	-
Siemens	Scalance W734-1 Firmware	-
Siemens	Scalance W734-1	-
Siemens	Scalance W738-1 Firmware	-
Siemens	Scalance W738-1	-

Related Weaknesses (CWE)

CWE-327

References

http://www.openwall.com/lists/oss-security/2021/05/11/12Mailing ListThird Party Advisory
https://cert-portal.siemens.com/productcert/pdf/ssa-913875.pdfThird Party Advisory
https://github.com/vanhoefm/fragattacks/blob/master/SUMMARY.mdThird Party Advisory
https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-wThird Party Advisory
https://www.arista.com/en/support/advisories-notices/security-advisories/12602-sThird Party Advisory
https://www.fragattacks.comThird Party Advisory
http://www.openwall.com/lists/oss-security/2021/05/11/12Mailing ListThird Party Advisory
https://cert-portal.siemens.com/productcert/pdf/ssa-913875.pdfThird Party Advisory
https://github.com/vanhoefm/fragattacks/blob/master/SUMMARY.mdThird Party Advisory
https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-wThird Party Advisory
https://www.arista.com/en/support/advisories-notices/security-advisories/12602-sThird Party Advisory
https://www.fragattacks.comThird Party Advisory
https://cert-portal.siemens.com/productcert/html/ssa-019200.html
https://cert-portal.siemens.com/productcert/html/ssa-913875.html

FAQ

What is CVE-2020-26140?

CVE-2020-26140 is a vulnerability with a CVSS score of 6.5 (MEDIUM). An issue was discovered in the ALFA Windows 10 driver 6.1316.1209 for AWUS036H. The WEP, WPA, WPA2, and WPA3 implementations accept plaintext frames in a protected Wi-Fi network. An adversary can abus...

How severe is CVE-2020-26140?

CVE-2020-26140 has been rated MEDIUM with a CVSS base score of 6.5/10. Review the CVSS metrics above for detailed severity breakdown.

Is there a patch for CVE-2020-26140?

Check the references section above for vendor advisories and patch information. Affected products include: Alfa Awus036H Firmware, Alfa Awus036H, Siemens Scalance W1748-1 Firmware, Siemens Scalance W1748-1, Siemens Scalance W1750D Firmware.