PT-2021-3059 · Alfa+4 · Alfa Windows 10 Driver+4

Mathy Vanhoef · Published 2021-05-11 · Updated 2025-08-20 · CVE-2020-26140

Positive Technologies (AI Summary)

CVSS v3.1

6.5

Medium

Base vector

AV:A/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N

Name of the Vulnerable Software and Affected Versions ALFA Windows 10 driver version 6.1316.1209 for AWUS036H

Description An issue was discovered in the ALFA Windows 10 driver where the WEP, WPA, WPA2, and WPA3 implementations accept plaintext frames in a protected Wi-Fi network. This allows an adversary to inject arbitrary data frames independent of the network configuration.

Recommendations For ALFA Windows 10 driver version 6.1316.1209, consider disabling the use of WEP, WPA, WPA2, and WPA3 until a patch is available to prevent exploitation. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Special Elements Injection

Use of a Broken Cryptographic Algorithm

Weakness Enumeration

CWE-74

CWE-327

Related Identifiers

ALSA-2021:4356

BDU:2021-02666

CESA-2021_4140

CESA-2021_4356

CVE-2020-26140

OESA-2022-2017

RHSA-2021:4140

RHSA-2021:4356

RHSA-2021_4140

RHSA-2021_4356

Affected Products

Alfa Windows 10 Driver

Almalinux

Centos

Check Point Gaia

Red Hat

References · 79

• https://osv.dev/vulnerability/CVE-2020-26140 · Vendor Advisory
• https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-wifi-faf-22epcEWu · Vendor Advisory
• https://linux.oracle.com/errata/ELSA-2021-9459.html · Vendor Advisory
• https://bdu.fstec.ru/vul/2021-02666 · Security Note
• https://osv.dev/vulnerability/ALSA-2021:4356 · Vendor Advisory
• https://linux.oracle.com/errata/ELSA-2021-4356.html · Vendor Advisory
• https://osv.dev/vulnerability/OESA-2022-2017 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2020-26140 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2020-26143 · Security Note
• https://cve.org/CVERecord?id=CVE-2020-26140 · Security Note
• https://osv.dev/vulnerability/UBUNTU-CVE-2020-26140 · Vendor Advisory
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-26140 · Security Note
• https://ubuntu.com/security/CVE-2020-26140 · Vendor Advisory
• https://github.com/vanhoefm/fragattacks/blob/master/SUMMARY.md · Note
• https://cert-portal.siemens.com/productcert/html/ssa-913875.html · Note