CVE-2020-26146 Information disclosure in n/a

Medium 5.3 Published 11 May 2021 Updated 2 Jun 2026

Attackers can exfiltrate selected fragments from WPA/WPA2/WPA3 implementations by abusing non-consecutive packet number reassembly in Android devices.

Exploited in the wild: Not known
Login needed: Not needed
Attackable: Local or same network only
Victim action needed: Not needed
Fix: Available

What is CVE-2020-26146?

CVE-2020-26146 is a medium-severity vulnerability in Siemens Scalance W1750d Firmware, published on 11 May 2021. It can only be exploited from the same machine or local network, with no action from the victim.

Official description

An issue was discovered on Samsung Galaxy S3 i9305 4.4.4 devices. The WPA, WPA2, and WPA3 implementations reassemble fragments with non-consecutive packet numbers. An adversary can abuse this to exfiltrate selected fragments. This vulnerability is exploitable when another device sends fragmented frames and the WEP, CCMP, or GCMP data-confidentiality protocol is used. Note that WEP is vulnerable to this attack by design.

Weakness: CWE-20

Which versions are affected by CVE-2020-26146?

It affects 19 products.

Products include Arista C-100 Firmware, Arista C-110 Firmware, Arista C-120 Firmware, Arista C-130 Firmware, Arista C-200 Firmware, Arista C-230 Firmware and 13 more.

How do I fix CVE-2020-26146?

Apply the vendor's patch.

Is CVE-2020-26146 being exploited?

There is no known exploitation of CVE-2020-26146 in the wild and no public exploit code.

All Siemens Scalance W1750d Firmware vulnerabilities

Sources

Also known as 2860242, 2874369, A-175626808, ASB-A-175626808, GHSA-pwgj-jw9h-pg74, ROOT-OS-UBUNTU-2204-CVE-2020-26146 and 1 more.