Login Request a demo
Medium severity · published May 11, 2021
CVE-2020-26145
An issue was discovered on Samsung Galaxy S3 i9305 4.4.4 devices
6.5
CVSS
3.5%
EPSS
No
On KEV
Description
An issue was discovered on Samsung Galaxy S3 i9305 4.4.4 devices. The WEP, WPA, WPA2, and WPA3 implementations accept second (or subsequent) broadcast fragments even when sent in plaintext and process them as full unfragmented frames. An adversary can abuse this to inject arbitrary network packets independent of the network configuration.
CVSS vector
CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N
Attack vector
Adjacent
Complexity
Low
Privileges
None
User interaction
None
Confidentiality
None
Integrity
High
Availability
None
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)3.5% · higher than 89% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
6F
6gk5763-1al00-3aa0 Firmware · Siemens
before 1.2 · source: NVD
6F
6gk5763-1al00-3da0 Firmware · Siemens
before 1.2 · source: NVD
6F
6gk5763-1al00-7da0 Firmware · Siemens
before 1.2 · source: NVD
6F
6gk5766-1ge00-3da0 Firmware · Siemens
before 1.2 · source: NVD
6F
6gk5766-1ge00-3db0 Firmware · Siemens
before 1.2 · source: NVD
6F
6gk5766-1ge00-7da0 Firmware · Siemens
before 1.2 · source: NVD
6F
6gk5766-1ge00-7db0 Firmware · Siemens
before 1.2 · source: NVD
6F
6gk5766-1ge00-7ta0 Firmware · Siemens
before 1.2 · source: NVD
6F
6gk5766-1ge00-7tb0 Firmware · Siemens
before 1.2 · source: NVD
6F
6gk5766-1je00-3da0 Firmware · Siemens
before 1.2 · source: NVD
6F
6gk5766-1je00-7da0 Firmware · Siemens
before 1.2 · source: NVD
6F
6gk5766-1je00-7ta0 Firmware · Siemens
before 1.2 · source: NVD
Affected product
GI
Galaxy I9305 Firmware
Samsung
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2020-26145
CVE.org
https://www.cve.org/CVERecord?id=CVE-2020-26145
Mailing List
http://www.openwall.com/lists/oss-security/2021/05/11/12
Patch
https://cert-portal.siemens.com/productcert/pdf/ssa-913875.pdf
Third Party Advisory
https://github.com/vanhoefm/fragattacks/blob/master/SUMMARY.md
Third Party Advisory
https://www.fragattacks.com
cert-portal.siemens.com
https://cert-portal.siemens.com/productcert/html/ssa-913875.html
More from Galaxy I9305 Firmware
6.5
CVE-2020-26144
An issue was discovered on Samsung Galaxy S3 i9305 4.4.4 devices
5.3
CVE-2020-26146
An issue was discovered on Samsung Galaxy S3 i9305 4.4.4 devices