CVE-2020-24588

The 802.11 standard that underpins Wi-Fi Protected Access (WPA, WPA2, and WPA3) and Wired Equivalent Privacy (WEP) doesn't require that the A-MSDU flag in the…

published May 11, 2021

CVSS
—
EPSS
4%
Percentile
89.4
In the wild
Unconfirmed
What it is

The 802.11 standard that underpins Wi-Fi Protected Access (WPA, WPA2, and WPA3) and Wired Equivalent Privacy (WEP) doesn't require that the A-MSDU flag in the plaintext QoS header field is authenticated. Against devices that support receiving non-SSP A-MSDU frames (which is mandatory as part of 802.11n), an adversary can abuse this to inject arbitrary network packets.

The record
Technical detail
CVSS
Not scored
CVSS v4.0
Not supplied
EPSS
0.03611 · 89.4th percentile
Published
2021-05-11T00:00Z
EPSS history
Timeline
  • 11 MAY 00:00Z
    The 802.11 standard that underpins Wi-Fi Protected Access (WPA, WPA2, and WPA3) and Wired Equivalent Privacy (WEP) doesn't require that the A-MSDU flag in the…
    cvelistv5