CVE-2020-12638 An encryption-bypass issue was discovered on Espressif ESP-IDF devices through 4.2, ESP8266_NONOS_SDK devices through 3.0.3, and ESP8266_RTO

What is CVE-2020-12638?

CVE-2020-12638 is a medium-severity vulnerability in n/a, published on 23 Jul 2020.

Official description

An encryption-bypass issue was discovered on Espressif ESP-IDF devices through 4.2, ESP8266_NONOS_SDK devices through 3.0.3, and ESP8266_RTOS_SDK devices through 3.3. Broadcasting forged beacon frames forces a device to change its authentication mode to OPEN, effectively disabling its 802.11 encryption.

Weakness: CWE-319, CWE-287

Which versions are affected by CVE-2020-12638?

It affects 3 products.

Products include Espressif Esp-Idf, Espressif Esp8266 Nonos Sdk, Espressif Esp8266 Rtos Sdk.

How do I fix CVE-2020-12638?

No fix has been published for CVE-2020-12638 yet. Limit exposure of the affected software until one is available.

Is CVE-2020-12638 being exploited?

There is no known exploitation of CVE-2020-12638 in the wild and no public exploit code.

Other vulnerabilities in n/a

• CVE-2026-45328 ESF-IDF: Out-of-Bounds Write in ESP-TEE Secure Service Wrappers Critical 9.3
• CVE-2024-53406 Auth bypass in n/a High 8.8
• CVE-2021-28139 Memory corruption in n/a High 8.8
• CVE-2024-33453 Information disclosure in n/a High 8.1
• CVE-2019-12587 Weak cryptography in n/a High 8.1

Sources

• CVE record
• NVD
• OSV
• GitHub advisory
• How this page is made

Also known as GHSA-jf2p-5456-5593.