PT-2021-3061 · Alfa+4 · Alfa Windows 10 Driver+4

Mathy Vanhoef · Published 2021-05-11 · Updated 2023-03-03 · CVE-2020-26143

Positive Technologies (AI Summary)

CVSS v3.1

6.5

Medium

Base vector

AV:A/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N

Name of the Vulnerable Software and Affected Versions ALFA Windows 10 driver version 1030.36.604

Description An issue exists in the WEP, WPA, WPA2, and WPA3 implementations of the ALFA Windows 10 driver, allowing an adversary to inject arbitrary data frames into a protected Wi-Fi network by accepting fragmented plaintext frames. This is due to insufficient input validation in the driver's implementation of these algorithms. The vulnerability can be exploited to impact the integrity of protected information.

Recommendations For ALFA Windows 10 driver version 1030.36.604, consider disabling the use of WEP, WPA, WPA2, and WPA3 until a patch is available to prevent exploitation. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

RCE

Weakness Enumeration

CWE-20

Related Identifiers

ALSA-2021:4356

BDU:2021-02668

CESA-2021_4140

CESA-2021_4356

CVE-2020-26143

OESA-2022-2017

RHSA-2021:4140

RHSA-2021:4356

RHSA-2021_4140

RHSA-2021_4356

Affected Products

Alfa Windows 10 Driver

Almalinux

Centos

Check Point Gaia

Red Hat

References · 78

• https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-wifi-faf-22epcEWu · Vendor Advisory
• https://ubuntu.com/security/CVE-2020-26143 · Vendor Advisory
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-26143 · Security Note
• https://linux.oracle.com/errata/ELSA-2021-9459.html · Vendor Advisory
• https://osv.dev/vulnerability/ALSA-2021:4356 · Vendor Advisory
• https://bdu.fstec.ru/vul/2021-02668 · Security Note
• https://osv.dev/vulnerability/UBUNTU-CVE-2020-26143 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2020-26143 · Security Note
• https://linux.oracle.com/errata/ELSA-2021-4356.html · Vendor Advisory
• https://osv.dev/vulnerability/OESA-2022-2017 · Vendor Advisory
• https://cve.org/CVERecord?id=CVE-2020-26143 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2020-26140 · Security Note
• https://osv.dev/vulnerability/CVE-2020-26143 · Vendor Advisory
• https://github.com/vanhoefm/fragattacks/blob/master/SUMMARY.md · Note
• https://cert-portal.siemens.com/productcert/html/ssa-913875.html · Note