High severity · published Jul 6, 2020
CVE-2020-9395
An issue was discovered on Realtek RTL8195AM, RTL8711AM, RTL8711AF, and RTL8710AF devices before 2.0.6
8.0
CVSS
0.8%
EPSS
No
On KEV
Description
An issue was discovered on Realtek RTL8195AM, RTL8711AM, RTL8711AF, and RTL8710AF devices before 2.0.6. A stack-based buffer overflow exists in the client code that takes care of WPA2's 4-way-handshake via a malformed EAPOL-Key packet with a long keydata buffer.
CVSS vector
CVSS:3.1/AV:A/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:H
Attack vector
Adjacent
Complexity
High
Privileges
Low
User interaction
None
Confidentiality
High
Integrity
High
Availability
High
Scope
Changed
Exploitation
Is it being used?
Exploit prediction (EPSS)0.8% · higher than 56% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
RF
Rtl8195am Firmware · Realtek
before 2.0.6 · source: NVD
RF
Rtl8710af Firmware · Realtek
before 2.0.6 · source: NVD
RF
Rtl8711af Firmware · Realtek
before 2.0.6 · source: NVD
RF
Rtl8711am Firmware · Realtek
before 2.0.6 · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2020-9395
CVE.org
https://www.cve.org/CVERecord?id=CVE-2020-9395
Patch
https://github.com/ambiot/amb1_arduino/commit/dcea55cf9775a0166805b3db845b237ecd5e74ea#diff-d06e7a87f34cc464a56799a419033014
Patch
https://github.com/ambiot/amb1_sdk/commit/bc5173d5d4faf6829074b0f1e1b242c12b7777a3#diff-700c216fb376666eaeda0c892e8bdc09
Third Party Advisory
https://www.amebaiot.com/en/security_bulletin/
More from Rtl8195am Firmware
9.8
CVE-2021-39306
A stack buffer overflow was discovered on Realtek RTL8195AM device before 2.0.10, it exists in the client code when an attacker sends a big size Authentication challenge text in…
9.8
CVE-2021-43573
A buffer overflow was discovered on Realtek RTL8195AM devices before 2.0.10
7.5
CVE-2022-34326
In ambiot amb1_sdk (aka SDK for Ameba1) before 2022-06-20 on Realtek RTL8195AM devices before 284241d70308ff2519e40afd7b284ba892c730a3, the timer task and RX task would be locked…