PT-2020-6739 · Qualcomm+5 · Qualcomm Snapdragon Industrial Iot+13

Published

2020-08-07

·

Updated

2022-04-01

·

CVE-2020-3702

CVSS v3.1

6.5

Medium

VectorAV:A/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Name of the Vulnerable Software and Affected Versions Qualcomm Snapdragon Auto versions APQ8053 through SM7150 Qualcomm Snapdragon Compute versions APQ8053 through SM7150 Qualcomm Snapdragon Connectivity versions APQ8053 through SM7150 Qualcomm Snapdragon Consumer IOT versions APQ8053 through SM7150 Qualcomm Snapdragon Industrial IOT versions APQ8053 through SM7150 Qualcomm Snapdragon Mobile versions APQ8053 through SM7150 Qualcomm Snapdragon Voice & Music versions APQ8053 through SM7150 Qualcomm Snapdragon Wearables versions APQ8053 through SM7150 Qualcomm Snapdragon Wired Infrastructure and Networking versions APQ8053 through SM7150 MediaTek Wi-Fi chips (affected versions not specified)
Description The issue is related to improper layer 2 Wi-Fi encryption, allowing an attacker to intercept and decrypt Wi-Fi traffic protected by the WPA2 protocol. This can be achieved by sending specifically timed and handcrafted traffic to a WLAN device, causing internal errors. The vulnerability is similar to the Kr00k vulnerability and affects Qualcomm and MediaTek Wi-Fi chips.
Recommendations For Qualcomm Snapdragon Auto versions APQ8053 through SM7150, consider disabling the Wi-Fi functionality until a patch is available. For Qualcomm Snapdragon Compute versions APQ8053 through SM7150, restrict access to the WLAN device to minimize the risk of exploitation. For Qualcomm Snapdragon Connectivity versions APQ8053 through SM7150, avoid using the WPA2 protocol in the affected API endpoint until the issue is resolved. For Qualcomm Snapdragon Consumer IOT versions APQ8053 through SM7150, consider implementing additional security measures, such as encryption, to protect sensitive data. For Qualcomm Snapdragon Industrial IOT versions APQ8053 through SM7150, restrict access to the WLAN device and implement additional security measures to minimize the risk of exploitation. For Qualcomm Snapdragon Mobile versions APQ8053 through SM7150, consider disabling the Wi-Fi functionality until a patch is available. For Qualcomm Snapdragon Voice & Music versions APQ8053 through SM7150, restrict access to the WLAN device to minimize the risk of exploitation. For Qualcomm Snapdragon Wearables versions APQ8053 through SM7150, consider implementing additional security measures, such as encryption, to protect sensitive data. For Qualcomm Snapdragon Wired Infrastructure and Networking versions APQ8053 through SM7150, restrict access to the WLAN device and implement additional security measures to minimize the risk of exploitation. For MediaTek Wi-Fi chips, at the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

Cleartext Transmission of Sensitive Information

Found an issue in the description? Have something to add? Feel free to write us 👾

Weakness Enumeration

Related Identifiers

BDU:2022-05918
CVE-2020-3702
DLA-2785-1
DLA-2843-1
DSA-4978-1
MGASA-2021-0409
MGASA-2021-0419
OESA-2021-1429
OPENSUSE-SU-2021:1357-1
OPENSUSE-SU-2021:1365-1
OPENSUSE-SU-2021:3338-1
OPENSUSE-SU-2021:3387-1
OPENSUSE-SU-2021:3447-1
OPENSUSE-SU-2021:3876-1
OPENSUSE-SU-2021_1357-1
OPENSUSE-SU-2021_1365-1
OPENSUSE-SU-2021_3338-1
OPENSUSE-SU-2021_3387-1
OPENSUSE-SU-2021_3447-1
OPENSUSE-SU-2021_3876-1
SUSE-SU-2021:3337-1
SUSE-SU-2021:3338-1
SUSE-SU-2021:3339-1
SUSE-SU-2021:3386-1
SUSE-SU-2021:3387-1
SUSE-SU-2021:3388-1
SUSE-SU-2021:3389-1
SUSE-SU-2021:3415-1
SUSE-SU-2021:3447-1
SUSE-SU-2021:3876-1
SUSE-SU-2021:3929-1
SUSE-SU-2021:3935-1
SUSE-SU-2021:3969-1
SUSE-SU-2021:3972-1
SUSE-SU-2021_3337-1
SUSE-SU-2021_3338-1
SUSE-SU-2021_3339-1
SUSE-SU-2021_3386-1
SUSE-SU-2021_3387-1
SUSE-SU-2021_3389-1
SUSE-SU-2021_3447-1
SUSE-SU-2022:0234-1
SUSE-SU-2022:0237-1
SUSE-SU-2022:0241-1
SUSE-SU-2022:0243-1
SUSE-SU-2022:0246-1
SUSE-SU-2022:0254-1
SUSE-SU-2022:0255-1
SUSE-SU-2022:0257-1
SUSE-SU-2022:0263-1
SUSE-SU-2022:0267-1
SUSE-SU-2022:0291-1
SUSE-SU-2022:0292-1
SUSE-SU-2022:0293-1
SUSE-SU-2022:0295-1
SUSE-SU-2022:0296-1
SUSE-SU-2022:0298-1
SUSE-SU-2022:0325-1
SUSE-SU-2022:0327-1
SUSE-SU-2022:0328-1
SUSE-SU-2022_0246-1
USN-5113-1
USN-5114-1
USN-5115-1
USN-5116-1
USN-5116-2
USN-5361-1

Affected Products

Astra Linux
Linuxmint
Mediatek Wi-Fi Chips
Qualcomm Snapdragon Auto
Qualcomm Snapdragon Compute
Qualcomm Snapdragon Connectivity
Qualcomm Snapdragon Consumer Iot
Qualcomm Snapdragon Industrial Iot
Qualcomm Snapdragon Mobile
Qualcomm Snapdragon Voice & Music
Qualcomm Snapdragon Wearables
Qualcomm Snapdragon Wired Infrastructure/Networking
Suse
Ubuntu