CVE-2020-3702 Information disclosure in Snapdragon Auto, Snapdragon Compute, Snapdragon Connectivity, Snapdragon Consumer IOT, Snapdragon Industrial IOT, Snapdragon Mobile, Snapdragon Voice & Music, Snapdragon Wearables, Snapdragon Wired Infrastructure and Networking
Attackers can disclose information over the air by exploiting improper Wi-Fi encryption in Qualcomm Snapdragon chipsets via timed traffic.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Local or same network only
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2020-3702?
CVE-2020-3702 is a medium-severity vulnerability in Debian Debian Linux, published on 8 Sep 2020. It can only be exploited from the same machine or local network, with no action from the victim.
Official description
u'Specifically timed and handcrafted traffic can cause internal errors in a WLAN device that lead to improper layer 2 Wi-Fi encryption with a consequent possibility of information disclosure over the air for a discrete set of traffic' in Snapdragon Auto, Snapdragon Compute, Snapdragon Connectivity, Snapdragon Consumer IOT, Snapdragon Industrial IOT, Snapdragon Mobile, Snapdragon Voice & Music, Snapdragon Wearables, Snapdragon Wired Infrastructure and Networking in APQ8053, IPQ4019, IPQ8064, MSM8909W, MSM8996AU, QCA9531, QCN5502, QCS405, SDX20, SM6150, SM7150
Weakness: CWE-319
Which versions are affected by CVE-2020-3702?
It affects 13 products.
Products include Arista Access Point, Debian Debian Linux, Qualcomm Apq8053 Firmware, Qualcomm Ipq4019 Firmware, Qualcomm Ipq8064 Firmware, Qualcomm Msm8909w Firmware and 7 more.
How do I fix CVE-2020-3702?
Apply the vendor's patch.
Is CVE-2020-3702 being exploited?
There is no known exploitation of CVE-2020-3702 in the wild and no public exploit code.
Sources
Also known as DEBIAN-CVE-2020-3702, GHSA-h4q5-8rrj-hrj2, UBUNTU-CVE-2020-3702.