CVE-2020-24588 The 802.11 standard that underpins Wi-Fi Protected Access (WPA, WPA2, and WPA3) and Wired Equivalent Privacy (WEP) doesn't require that the

What is CVE-2020-24588?

CVE-2020-24588 is a low-severity vulnerability in Debian Debian Linux, published on 11 May 2021.

Official description

The 802.11 standard that underpins Wi-Fi Protected Access (WPA, WPA2, and WPA3) and Wired Equivalent Privacy (WEP) doesn't require that the A-MSDU flag in the plaintext QoS header field is authenticated. Against devices that support receiving non-SSP A-MSDU frames (which is mandatory as part of 802.11n), an adversary can abuse this to inject arbitrary network packets.

Weakness: CWE-327

Which versions are affected by CVE-2020-24588?

It affects 181 products.

Products include Arista C-100 Firmware, Arista C-110 Firmware, Arista C-120 Firmware, Arista C-130 Firmware, Arista C-200 Firmware, Arista C-230 Firmware and 175 more.

How do I fix CVE-2020-24588?

Upgrade to a fixed version.

Is CVE-2020-24588 being exploited?

There is no known exploitation of CVE-2020-24588 in the wild and no public exploit code.

Other vulnerabilities in Debian Debian Linux

• CVE-2020-26144 Other in n/a Medium 6.5
• CVE-2020-26139 Missing authorization in n/a Medium 5.3
• CVE-2020-26146 Information disclosure in n/a Medium 5.3
• CVE-2020-24587 The 802.11 standard that underpins Wi-Fi Protected Access (WPA, WPA2, and WPA3) and Wired Equivalent Privacy (WEP) doesn't require that all Low 2.6

All Debian Debian Linux vulnerabilities

Sources

• CVE record
• NVD
• OSV
• GitHub advisory
• How this page is made

Also known as 2861800, 2866467, 2867578, 2867994, 2868616, 2877094 and 13 more.