CVE-2020-24586: Arista C-200 Firmware

Low severity, CVSS 3.5. EPSS: 5.8% chance of exploitation in the next 30 days.

The 802.11 standard that underpins Wi-Fi Protected Access (WPA, WPA2, and WPA3) and Wired Equivalent Privacy (WEP) doesn't require that received fragments be cleared from memory after (re)connecting to a network. Under the right circumstances, when another device sends fragmented frames encrypted using WEP, CCMP, or GCMP, this can be abused to inject arbitrary network packets and/or exfiltrate user data.

Affected products

  • Arista C-200 Firmware: before 11.0.0-36 (fixed in 11.0.0-36)
  • Arista C-230 Firmware: before 10.0.1-31 (fixed in 10.0.1-31)
  • Arista C-235 Firmware: before 10.0.1-31 (fixed in 10.0.1-31)
  • Arista C-250 Firmware: before 10.0.1-31 (fixed in 10.0.1-31)
  • Arista C-260 Firmware: before 10.0.1-31 (fixed in 10.0.1-31)
  • Debian Debian Linux: version 9.0 only
  • Ieee Ieee 802.11: any version
  • Intel Ac 1550 Firmware: affected versions not specified
  • Intel Ac 3165 Firmware: before 19.51.33.1 (fixed in 19.51.33.1)
  • Intel Ac 3168 Firmware: before 19.51.33.1 (fixed in 19.51.33.1)
  • Intel Ac 7265 Firmware: before 19.51.33.1 (fixed in 19.51.33.1)
  • Intel Ac 8260 Firmware: before 20.70.21.2 (fixed in 20.70.21.2)
  • Intel Ac 8265 Firmware: before 20.70.21.2 (fixed in 20.70.21.2)
  • Intel Ac 9260 Firmware: before 22.30.0.11 (fixed in 22.30.0.11)
  • Intel Ac 9461 Firmware: before 22.30.0.11 (fixed in 22.30.0.11)
  • Intel Ac 9462 Firmware: before 22.30.0.11 (fixed in 22.30.0.11)
  • Intel Ac 9560 Firmware: before 22.30.0.11 (fixed in 22.30.0.11)
  • Intel AX1650 Firmware: affected versions not specified
  • Intel AX1675 Firmware: affected versions not specified
  • Intel AX200 Firmware: before 22.30.0.11 (fixed in 22.30.0.11)
  • Intel AX201 Firmware: before 22.30.0.11 (fixed in 22.30.0.11)
  • Intel AX210 Firmware: before 22.30.0.11 (fixed in 22.30.0.11)
  • Linux Linux Kernel: from 4.4, before 4.4.271 (fixed in 4.4.271); from 4.9, before 4.9.271 (fixed in 4.9.271); from 4.14, before 4.14.235 (fixed in 4.14.235); from 4.19, before 4.19.193 (fixed in 4.19.193); from 5.4, before 5.4.124 (fixed in 5.4.124); from 5.10, before 5.10.42 (fixed in 5.10.42); …
  • Linux MAC80211: affected versions not specified

Published 2021-05-11. Last modified 2026-06-17.