Input validation error in Juniper Networks, Inc. products - CVE-2020-26146

CSH
CYBERSECURITY HELP
Sign In REGISTER
 
Main Vulnerability Database Vulnerabilities #VU53167

Input validation error in Juniper Networks, Inc. products - CVE-2020-26146

Published: May 12, 2021 / Updated: May 19, 2021


Vulnerability identifier: #VU53167
CSH Severity: Low
CVSS v4: 6.8 [CVSS:4.0/AV:A/AC:L/AT:N/PR:N/UI:A/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N]
CVE-ID: CVE-2020-26146
CWE-ID: CWE-20
Exploitation vector: Adjecent network
Exploit availability: No public exploit available

Vulnerability details

The vulnerability allows a remote attacker to compromise the target system.

The vulnerability exists due to the WPA, WPA2, and WPA3 implementations reassemble fragments with non-consecutive packet numbers. A remote attacker on the local network can exfiltrate selected fragments.


Affected software

AP21
AP41
AP61
AP43
AP63
AP12
AP32
AP33
Mist Access Point
Cisco Catalyst 9130 Series Access Points
Cisco Catalyst 9117 Series Access Points
Meraki MR74
Integrated AP on 1100 Integrated Services Routers
Cisco Catalyst 9120 Series Access Points
Cisco Catalyst 9115 Series Wi-Fi 6 Access Points
Cisco Catalyst 9105 Series Access Points
Cisco Aironet 1850 Series Access Points
ESR6300 Embedded Series Routers
Cisco Catalyst IW 6300
Cisco 4800 Aironet Access Points
Cisco Aironet 3800 Series Access Points
GT25-WLAN
Cisco Aironet 1560 Series Access Points
Cisco Aironet 2800 Series Access Points
Cisco IP Phone 8861
Cisco IP Phone 8865
Aruba Instant
Meraki MR70
Meraki MR46
Meraki MR46E
Meraki MR52
Meraki MR53
Meraki MR53E
Meraki MR55
Meraki MR56
Meraki MR76
Meraki MR84
Meraki MR86
Cisco Meraki MX68CW
Meraki MR45
Meraki MR44
Meraki MR43E
Meraki MR43
Meraki MR42
Meraki MR36
Meraki MR33
Meraki MR30H
Meraki MR20
Meraki GR60
Meraki GR10
Cisco Meraki Z3C
Cisco Meraki MX68W
Cisco Meraki MX67CW
Cisco Meraki MX67W
Meraki Z3
Cisco Webex Desk Series
Cisco Webex Room Series
Cisco Webex Board
Webex Wireless Phone 840
Webex Wireless Phone 860
Cisco IP Conference Phone 8832
Cisco IP Phone 6861
Cisco Wireless IP Phone 8821
TropOS
ArubaOS (AOS)
Red Hat Enterprise Linux for Real Time
Red Hat CodeReady Linux Builder for ARM 64
Red Hat Enterprise Linux for Real Time for NFV
Red Hat Enterprise Linux for x86_64
Red Hat Enterprise Linux for IBM z Systems
Red Hat Enterprise Linux for Power, little endian
Red Hat Enterprise Linux for ARM 64
Red Hat CodeReady Linux Builder for x86_64
Red Hat CodeReady Linux Builder for Power, little endian
Google Android
kernel (Red Hat package)
kernel-rt (Red Hat package)

How to mitigate CVE-2020-26146

Install updates from vendor's website.

Mist Access Point - addressed in versions 0.5.17562, 0.6.19227, 0.7.20564, 0.8.21602, 0.9.22792
TropOS - update to 8.9.4.9
ArubaOS (AOS) - addressed in versions 6.4.4.25, 6.5.4.19, 8.3.0.15, 8.5.0.12, 8.6.0.8, 8.7.1.2
Aruba Instant - addressed in versions 6.5.4.19, 8.3.0.15, 8.5.0.12, 8.6.0.8, 8.7.1.2
Google Android - addressed in versions 8.1 2021-10-05, 9 2021-10-05, 10 2021-10-05, 11 2021-10-05
kernel (Red Hat package) - update to 4.18.0-348.el8
kernel-rt (Red Hat package) - update to 4.18.0-348.rt7.130.el8

External References

Related Security Bulletins