Vulnerability in Arista C-100
CVE-2020-24587
The 802.11 standard that underpins Wi-Fi Protected Access (WPA, WPA2, and WPA3) and Wired Equivalent Privacy (WEP) doesn't require that all fragments of a frame are encrypted under the same key. An adversary can abuse this to decrypt selected fragments when another device sends fragmented frames and the WEP, CCMP, or GCMP encryption key is periodically renewed.
Vulnerability class: POODLE (CVE-2014-3566)
EPSS: 0.026 (84.5th percentile) — read the EPSS interpretation.
CVSS v3 metric
CVSS v3 base score 2.6 (Low). Vector: CVSS:3.1/AV:A/AC:H/PR:N/UI:R/S:U/C:L/I:N/A:N.
Affected products
Weakness classification (CWE)
Public proof-of-concept exploits
References
- cve@mitre.org (Third Party Advisory)
- cve@mitre.org (vendor-advisory, Third Party Advisory)
- cve@mitre.org (Exploit, Third Party Advisory)
- cve@mitre.org (Third Party Advisory)
- cve@mitre.org (mailing-list, Mailing List, Third Party Advisory)
- cve@mitre.org (mailing-list, Mailing List, Third Party Advisory)
- cve@mitre.org (mailing-list, Mailing List, Third Party Advisory)
- cve@mitre.org (Third Party Advisory)
- cve@mitre.org (mailing-list)
Frequently asked questions
- What is CVE-2020-24587?
- CVE-2020-24587 is a low-severity vulnerability in Arista C-100, classified under Use of a Broken or Risky Cryptographic Algorithm. CVSS score: 2.6/10. Published 2021-05-11.
- How severe is CVE-2020-24587?
- Low severity. CVSS v3 base score is 2.6 out of 10.
- Is CVE-2020-24587 known to be exploited?
- 3 public proof-of-concept repositories are indexed. Not currently listed in the CISA KEV catalog.