CVE-2020-26144: Arista C-100 Firmware
Medium severity, CVSS 6.5. EPSS: 4.9% chance of exploitation in the next 30 days.
An issue was discovered on Samsung Galaxy S3 i9305 4.4.4 devices. The WEP, WPA, WPA2, and WPA3 implementations accept plaintext A-MSDU frames as long as the first 8 bytes correspond to a valid RFC1042 (i.e., LLC/SNAP) header for EAPOL. An adversary can abuse this to inject arbitrary network packets independent of the network configuration.
Affected products
- Arista C-100 Firmware: before 11.0.0-36 (fixed in 11.0.0-36)
- Arista C-110 Firmware: before 11.0.0-36 (fixed in 11.0.0-36)
- Arista C-120 Firmware: before 11.0.0-36 (fixed in 11.0.0-36)
- Arista C-130 Firmware: before 11.0.0-36 (fixed in 11.0.0-36)
- Arista C-200 Firmware: before 11.0.0-36 (fixed in 11.0.0-36)
- Arista C-230 Firmware: before 10.0.1-31 (fixed in 10.0.1-31)
- Arista C-235 Firmware: before 10.0.1-31 (fixed in 10.0.1-31)
- Arista C-250 Firmware: before 10.0.1-31 (fixed in 10.0.1-31)
- Arista C-260 Firmware: before 10.0.1-31 (fixed in 10.0.1-31)
- Arista C-65 Firmware: affected versions not specified
- Arista C-75 Firmware: affected versions not specified
- Arista O-105 Firmware: before 11.0.0-36 (fixed in 11.0.0-36)
- Arista O-90 Firmware: affected versions not specified
- Arista W-118 Firmware: before 11.0.0-36 (fixed in 11.0.0-36)
- Arista W-68 Firmware: affected versions not specified
- Samsung Galaxy i9305 Firmware: version 4.4.4 only
- Siemens Scalance w700 Ieee 802.11ax Firmware: any version
- Siemens Scalance w700 Ieee 802.11n Firmware: any version
Published 2021-05-11. Last modified 2026-10-08.