Input validation error in Juniper Networks, Inc. products - CVE-2020-26142

CSH
CYBERSECURITY HELP
Sign In REGISTER
 
Main Vulnerability Database Vulnerabilities #VU53175

Input validation error in Juniper Networks, Inc. products - CVE-2020-26142

Published: May 12, 2021


Vulnerability identifier: #VU53175
CSH Severity: Low
CVSS v4: 6.8 [CVSS:4.0/AV:A/AC:L/AT:N/PR:N/UI:A/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N]
CVE-ID: CVE-2020-26142
CWE-ID: CWE-20
Exploitation vector: Adjecent network
Exploit availability: No public exploit available

Vulnerability details

The vulnerability allows a remote attacker to compromise the target system.

The vulnerability exists due to the WEP, WPA, WPA2, and WPA3 implementations treat fragmented frames as full frames. A remote attacker on the local network can inject arbitrary network packets, independent of the network configuration.


Affected software

AP21
AP41
AP61
AP43
AP63
AP12
AP32
AP33
Mist Access Point
Meraki MR74
Cisco IP Phone 8861
Cisco IP Phone 8865
Meraki MR53
Meraki MR33
Meraki MR36
Meraki MR42
Meraki MR43
Meraki MR43E
Meraki MR44
Meraki MR45
Meraki MR46
Meraki MR46E
Meraki MR52
Meraki MR53E
Meraki MR55
Meraki MR56
Meraki MR70
Meraki MR76
Meraki MR84
Meraki MR86
Meraki MR20
Meraki Z3
Cisco Meraki MX67W
Cisco Meraki MX67CW
Cisco Meraki MX68W
Cisco Meraki MX68CW
Cisco Meraki Z3C
Meraki GR10
Meraki GR60
Meraki MR30H
Webex Wireless Phone 840
Webex Wireless Phone 860
Cisco Wireless IP Phone 8821
Cisco IP Phone 6861
Cisco IP Conference Phone 8832
TropOS
Cisco Webex Board
Cisco Webex Desk Series
Cisco Webex Room Series
ESP-IDF

How to mitigate CVE-2020-26142

Install updates from vendor's website.

Mist Access Point - addressed in versions 0.5.17562, 0.6.19227, 0.7.20564, 0.8.21602, 0.9.22792
TropOS - update to 8.9.4.9
ESP-IDF - addressed in versions 5.1.3, 5.3

External References

Related Security Bulletins