CVE-2020-26146: Arista C-100 Firmware
Medium severity, CVSS 5.3. EPSS: 5.6% chance of exploitation in the next 30 days.
An issue was discovered on Samsung Galaxy S3 i9305 4.4.4 devices. The WPA, WPA2, and WPA3 implementations reassemble fragments with non-consecutive packet numbers. An adversary can abuse this to exfiltrate selected fragments. This vulnerability is exploitable when another device sends fragmented frames and the WEP, CCMP, or GCMP data-confidentiality protocol is used. Note that WEP is vulnerable to this attack by design.
Affected products
- Arista C-100 Firmware: before 11.0.0-36 (fixed in 11.0.0-36)
- Arista C-110 Firmware: before 11.0.0-36 (fixed in 11.0.0-36)
- Arista C-120 Firmware: before 11.0.0-36 (fixed in 11.0.0-36)
- Arista C-130 Firmware: before 11.0.0-36 (fixed in 11.0.0-36)
- Arista C-200 Firmware: before 11.0.0-36 (fixed in 11.0.0-36)
- Arista C-230 Firmware: before 10.0.1-31 (fixed in 10.0.1-31)
- Arista C-235 Firmware: before 10.0.1-31 (fixed in 10.0.1-31)
- Arista C-250 Firmware: before 10.0.1-31 (fixed in 10.0.1-31)
- Arista C-260 Firmware: before 10.0.1-31 (fixed in 10.0.1-31)
- Arista C-65 Firmware: affected versions not specified
- Arista C-75 Firmware: affected versions not specified
- Arista O-105 Firmware: before 11.0.0-36 (fixed in 11.0.0-36)
- Arista O-90 Firmware: affected versions not specified
- Arista W-118 Firmware: before 11.0.0-36 (fixed in 11.0.0-36)
- Arista W-68 Firmware: affected versions not specified
- Samsung Galaxy i9305 Firmware: version 4.4.4 only
- Siemens Scalance w1700 Ieee 802.11ac Firmware: any version
- Siemens Scalance w1750d Firmware: before 8.7.1.3 (fixed in 8.7.1.3)
- Siemens Scalance w700 Ieee 802.11n Firmware: any version
Published 2021-05-11. Last modified 2026-06-17.