CVE-2020-26146

Published: May 11, 2021Modified: Jun 17, 2026

5.3

Vector

CVSS:3.1/AV:A/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N

Exploitability: 1.6 / Impact: 3.6

Source: NVD

Description

An issue was discovered on Samsung Galaxy S3 i9305 4.4.4 devices. The WPA, WPA2, and WPA3 implementations reassemble fragments with non-consecutive packet numbers. An adversary can abuse this to exfiltrate selected fragments. This vulnerability is exploitable when another device sends fragmented frames and the WEP, CCMP, or GCMP data-confidentiality protocol is used. Note that WEP is vulnerable to this attack by design.

Affected (19)

Products: Samsung: Galaxy I9305 Firmware · Arista: C 250 Firmware, C 260 Firmware, C 230 Firmware, C 235 Firmware, C 200 Firmware, C 120 Firmware, C 130 Firmware, C 100 Firmware, C 110 Firmware, O 105 Firmware, W 118 Firmware, C 75 Firmware, O 90 Firmware, C 65 Firmware, W 68 Firmware · Siemens: Scalance W700 Ieee 802.11n Firmware, Scalance W1700 Ieee 802.11ac Firmware, Scalance W1750d Firmware

Samsung

1 product

Galaxy I9305 Firmware

15 products

3 products

Scalance W700 Ieee 802.11n Firmware

Scalance W1700 Ieee 802.11ac Firmware

Scalance W1750d Firmware

Configuration A

1 vulnerable · 1 platform

Vulnerable Software	Affected Versions
Samsung Galaxy I9305 Firmware	Version 4.4.4

Running on/with	Platform Versions
Samsung Galaxy I9305	All versions

Configuration B

1 vulnerable · 1 platform

Vulnerable Software	Affected Versions
Arista C 250 Firmware	Before 10.0.1-31

Running on/with	Platform Versions
Arista C 250	All versions

Configuration C

1 vulnerable · 1 platform

Vulnerable Software	Affected Versions
Arista C 260 Firmware	Before 10.0.1-31

Running on/with	Platform Versions
Arista C 260	All versions

Configuration D

1 vulnerable · 1 platform

Vulnerable Software	Affected Versions
Arista C 230 Firmware	Before 10.0.1-31

Running on/with	Platform Versions
Arista C 230	All versions

Configuration E

1 vulnerable · 1 platform

Vulnerable Software	Affected Versions
Arista C 235 Firmware	Before 10.0.1-31

Running on/with	Platform Versions
Arista C 235	All versions

Configuration F

1 vulnerable · 1 platform

Vulnerable Software	Affected Versions
Arista C 200 Firmware	Before 11.0.0-36

Running on/with	Platform Versions
Arista C 200	All versions

Configuration G

1 vulnerable · 1 platform

Vulnerable Software	Affected Versions
Arista C 120 Firmware	Before 11.0.0-36

Running on/with	Platform Versions
Arista C 120	All versions

Configuration H

1 vulnerable · 1 platform

Vulnerable Software	Affected Versions
Arista C 130 Firmware	Before 11.0.0-36

Running on/with	Platform Versions
Arista C 130	All versions

Configuration I

1 vulnerable · 1 platform

Vulnerable Software	Affected Versions
Arista C 100 Firmware	Before 11.0.0-36

Running on/with	Platform Versions
Arista C 100	All versions

Configuration J

1 vulnerable · 1 platform

Vulnerable Software	Affected Versions
Arista C 110 Firmware	Before 11.0.0-36

Running on/with	Platform Versions
Arista C 110	All versions

Configuration K

1 vulnerable · 1 platform

Vulnerable Software	Affected Versions
Arista O 105 Firmware	Before 11.0.0-36

Running on/with	Platform Versions
Arista O 105	All versions

Configuration L

1 vulnerable · 1 platform

Vulnerable Software	Affected Versions
Arista W 118 Firmware	Before 11.0.0-36

Running on/with	Platform Versions
Arista W 118	All versions

Configuration M

1 vulnerable · 1 platform

Vulnerable Software	Affected Versions
Arista C 75 Firmware	All versions

Running on/with	Platform Versions
Arista C 75	All versions

Configuration N

1 vulnerable · 1 platform

Vulnerable Software	Affected Versions
Arista O 90 Firmware	All versions

Running on/with	Platform Versions
Arista O 90	All versions

Configuration O

1 vulnerable · 1 platform

Vulnerable Software	Affected Versions
Arista C 65 Firmware	All versions

Running on/with	Platform Versions
Arista C 65	All versions

Configuration P

1 vulnerable · 1 platform

Vulnerable Software	Affected Versions
Arista W 68 Firmware	All versions

Running on/with	Platform Versions
Arista W 68	All versions

Configuration Q

1 vulnerable · 1 platform

Vulnerable Software	Affected Versions
Siemens Scalance W700 Ieee 802.11n Firmware	All versions

Running on/with	Platform Versions
Siemens Scalance W700 Ieee 802.11n	All versions

Configuration R

1 vulnerable · 1 platform

Vulnerable Software	Affected Versions
Siemens Scalance W1700 Ieee 802.11ac Firmware	All versions

Running on/with	Platform Versions
Siemens Scalance W1700 Ieee 802.11ac	All versions

Configuration S

1 vulnerable · 1 platform

Vulnerable Software	Affected Versions
Siemens Scalance W1750d Firmware	Before 8.7.1.3

Running on/with	Platform Versions
Siemens Scalance W1750d	All versions

Related CWEs

CWE-20

Improper Input Validation

The product receives input or data, but it does not validate or incorrectly validates that the input has the properties that are required to process the data safely and correctly.

References (14)

http://www.openwall.com/lists/oss-security/2021/05/11/12

Source: cve@mitre.org

Mailing ListThird Party Advisory

https://cert-portal.siemens.com/productcert/pdf/ssa-913875.pdf

Source: cve@mitre.org

Third Party Advisory

https://github.com/vanhoefm/fragattacks/blob/master/SUMMARY.md

Source: cve@mitre.org

Third Party Advisory

https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-wifi-faf-22epcEWu

Source: cve@mitre.org

Third Party Advisory

https://www.arista.com/en/support/advisories-notices/security-advisories/12602-security-advisory-63

Source: cve@mitre.org

Third Party Advisory

https://www.fragattacks.com

Source: cve@mitre.org

Third Party Advisory

http://www.openwall.com/lists/oss-security/2021/05/11/12