CVE-2020-11264 Auth bypass in Snapdragon Auto, Snapdragon Compute, Snapdragon Connectivity, Snapdragon Consumer Electronics Connectivity, Snapdragon Consumer IOT, Snapdragon Industrial IOT, Snapdragon Mobile, Snapdragon Voice & Music

Critical 9.1 Published 8 Sep 2021 Updated 4 Aug 2024

Improper authentication in the four-way handshake allows attackers to inject arbitrary network packets into Snapdragon-based devices.

Exploited in the wild: Not known
Login needed: Not needed
Attackable: Over the internet
Victim action needed: Not needed
Fix: Available

What is CVE-2020-11264?

CVE-2020-11264 is a critical authentication bypass vulnerability in Qualcomm Apq8053 Firmware, published on 8 Sep 2021. An attacker can exploit it over the internet without logging in, with no action from the victim.

Official description

Improper authentication of Non-EAPOL/WAPI plaintext frames during four-way handshake can lead to arbitrary network packet injection in Snapdragon Auto, Snapdragon Compute, Snapdragon Connectivity, Snapdragon Consumer Electronics Connectivity, Snapdragon Consumer IOT, Snapdragon Industrial IOT, Snapdragon Mobile, Snapdragon Voice & Music

Weakness: CWE-287

Which versions are affected by CVE-2020-11264?

It affects 126 products.

Products include Qualcomm Apq8053 Firmware, Qualcomm Apq8064au Firmware, Qualcomm Apq8096au Firmware, Qualcomm Aqt1000 Firmware, Qualcomm Ar8031 Firmware, Qualcomm Ar8035 Firmware and 120 more.

How do I fix CVE-2020-11264?

Apply the vendor's patch.

Upgrade, and rotate credentials and sessions that may have been exposed. More about Authentication bypass.

Is CVE-2020-11264 being exploited?

There is no known exploitation of CVE-2020-11264 in the wild and no public exploit code.

All Qualcomm Apq8053 Firmware vulnerabilities

Sources

Also known as 2860206, A-175608649, ASB-A-175608649, GHSA-jm3v-7p2w-cvmp.