{"id":"CVE-2020-26140","title":"An issue was discovered in the ALFA Windows 10 driver 6.1316.1209 for AWUS036H","summary":"An issue was discovered in the ALFA Windows 10 driver 6.1316.1209 for AWUS036H. The WEP, WPA, WPA2, and WPA3 implementations accept plaintext frames in a protected Wi-Fi network. An adversary can abuse this to inject arbitrary data frame…","severity":"medium","cvss":6.5,"cvssVector":"CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N","cwe":["CWE-327"],"vendor":"alfa","product":"awus036h_firmware","affected":["awus036h_firmware = 6.1316.1209","scalance_w1748-1_firmware","scalance_w1750d_firmware","scalance_w1788-1_firmware","scalance_w1788-2_firmware","scalance_w1788-2ia_firmware","scalance_w721-1_firmware","scalance_w722-1_firmware","scalance_w734-1_firmware","scalance_w738-1_firmware","scalance_w748-1_firmware","scalance_w761-1_firmware","scalance_w774-1_firmware","scalance_w778-1_firmware","scalance_w786-1_firmware","scalance_w786-2_firmware","scalance_w786-2ia_firmware","scalance_w788-1_firmware","scalance_w788-2_firmware","scalance_wam763-1_firmware","scalance_wam766-1_firmware","scalance_wam766-1_6ghz_firmware","scalance_wum763-1_firmware","scalance_wum766-1_firmware","scalance_wum766-1_6ghz_firmware","c-100_firmware","c-110_firmware","c-120_firmware","c-130_firmware","c-200_firmware","c-230_firmware","c-235_firmware","c-250_firmware","c-260_firmware","c-65_firmware","c-75_firmware","o-105_firmware","o-90_firmware","w-118_firmware","w-68_firmware","1100_firmware","1100-4p_firmware","1100-8p_firmware","1101-4p_firmware","1109-2p_firmware","1109-4p_firmware","aironet_1532_firmware","aironet_1542d_firmware","aironet_1542i_firmware","aironet_1552_firmware","aironet_1552h_firmware","aironet_1560_firmware","aironet_1562d_firmware","aironet_1562e_firmware","aironet_1562i_firmware","aironet_1572_firmware","aironet_1702_firmware","aironet_1800_firmware","aironet_1800i_firmware","aironet_1810_firmware","aironet_1810w_firmware","aironet_1815_firmware","aironet_1815i_firmware","aironet_1832_firmware","aironet_1842_firmware","aironet_1852_firmware","aironet_2702_firmware","aironet_2800_firmware","aironet_2800e_firmware","aironet_2800i_firmware","aironet_3702_firmware","aironet_3800_firmware","aironet_3800e_firmware","aironet_3800i_firmware","aironet_3800p_firmware","aironet_4800_firmware","aironet_ap803_firmware","aironet_iw3702_firmware","catalyst_9105_firmware","catalyst_9105axi_firmware","catalyst_9105axw_firmware","catalyst_9115_firmware","catalyst_9115_ap_firmware","catalyst_9115axe_firmware","catalyst_9115axi_firmware","catalyst_9117_firmware","catalyst_9117_ap_firmware","catalyst_9117axi_firmware","catalyst_9120_firmware","catalyst_9120_ap_firmware","catalyst_9120axe_firmware","catalyst_9120axi_firmware","catalyst_9120axp_firmware","catalyst_9124_firmware","catalyst_9124axd_firmware","catalyst_9124axi_firmware","catalyst_9130_firmware","catalyst_9130_ap_firmware","catalyst_9130axe_firmware","catalyst_9130axi_firmware"],"published":"2021-05-11","updated":"2026-10-08","sourceUpdated":"2026-10-08T22:16:58.123","source":"NVD","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2020-26140","references":[{"url":"http://www.openwall.com/lists/oss-security/2021/05/11/12","label":"cve@mitre.org"},{"url":"https://cert-portal.siemens.com/productcert/pdf/ssa-913875.pdf","label":"cve@mitre.org"},{"url":"https://github.com/vanhoefm/fragattacks/blob/master/SUMMARY.md","label":"cve@mitre.org"},{"url":"https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-wifi-faf-22epcEWu","label":"cve@mitre.org"},{"url":"https://www.arista.com/en/support/advisories-notices/security-advisories/12602-security-advisory-63","label":"cve@mitre.org"},{"url":"https://www.fragattacks.com","label":"cve@mitre.org"},{"url":"http://www.openwall.com/lists/oss-security/2021/05/11/12","label":"af854a3a-2127-422b-91ae-364da2661108"},{"url":"https://cert-portal.siemens.com/productcert/pdf/ssa-913875.pdf","label":"af854a3a-2127-422b-91ae-364da2661108"},{"url":"https://github.com/vanhoefm/fragattacks/blob/master/SUMMARY.md","label":"af854a3a-2127-422b-91ae-364da2661108"},{"url":"https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-wifi-faf-22epcEWu","label":"af854a3a-2127-422b-91ae-364da2661108"},{"url":"https://www.arista.com/en/support/advisories-notices/security-advisories/12602-security-advisory-63","label":"af854a3a-2127-422b-91ae-364da2661108"},{"url":"https://www.fragattacks.com","label":"af854a3a-2127-422b-91ae-364da2661108"},{"url":"https://cert-portal.siemens.com/productcert/html/ssa-019200.html","label":"0b142b55-0307-4c5a-b3c9-f314f3fb7c5e"},{"url":"https://cert-portal.siemens.com/productcert/html/ssa-913875.html","label":"0b142b55-0307-4c5a-b3c9-f314f3fb7c5e"}],"tags":["nvd"],"epss":0.02923,"epssPercentile":0.86681,"ingestedAt":"2026-10-08T23:16:47.319Z","slug":"CVE-2020-26140","body":"## Overview\n\nAn issue was discovered in the ALFA Windows 10 driver 6.1316.1209 for AWUS036H. The WEP, WPA, WPA2, and WPA3 implementations accept plaintext frames in a protected Wi-Fi network. An adversary can abuse this to inject arbitrary data frames independent of the network configuration.\n\n## Affected\n\n- `awus036h_firmware = 6.1316.1209`\n- `scalance_w1748-1_firmware`\n- `scalance_w1750d_firmware`\n- `scalance_w1788-1_firmware`\n- `scalance_w1788-2_firmware`\n- `scalance_w1788-2ia_firmware`\n- `scalance_w721-1_firmware`\n- `scalance_w722-1_firmware`\n- `scalance_w734-1_firmware`\n- `scalance_w738-1_firmware`\n- `scalance_w748-1_firmware`\n- `scalance_w761-1_firmware`\n- `scalance_w774-1_firmware`\n- `scalance_w778-1_firmware`\n- `scalance_w786-1_firmware`\n- `scalance_w786-2_firmware`\n- `scalance_w786-2ia_firmware`\n- `scalance_w788-1_firmware`\n- `scalance_w788-2_firmware`\n- `scalance_wam763-1_firmware`\n- `scalance_wam766-1_firmware`\n- `scalance_wam766-1_6ghz_firmware`\n- `scalance_wum763-1_firmware`\n- `scalance_wum766-1_firmware`\n- `scalance_wum766-1_6ghz_firmware`\n- `c-100_firmware`\n- `c-110_firmware`\n- `c-120_firmware`\n- `c-130_firmware`\n- `c-200_firmware`\n- `c-230_firmware`\n- `c-235_firmware`\n- `c-250_firmware`\n- `c-260_firmware`\n- `c-65_firmware`\n- `c-75_firmware`\n- `o-105_firmware`\n- `o-90_firmware`\n- `w-118_firmware`\n- `w-68_firmware`\n- `1100_firmware`\n- `1100-4p_firmware`\n- `1100-8p_firmware`\n- `1101-4p_firmware`\n- `1109-2p_firmware`\n- `1109-4p_firmware`\n- `aironet_1532_firmware`\n- `aironet_1542d_firmware`\n- `aironet_1542i_firmware`\n- `aironet_1552_firmware`\n- `aironet_1552h_firmware`\n- `aironet_1560_firmware`\n- `aironet_1562d_firmware`\n- `aironet_1562e_firmware`\n- `aironet_1562i_firmware`\n- `aironet_1572_firmware`\n- `aironet_1702_firmware`\n- `aironet_1800_firmware`\n- `aironet_1800i_firmware`\n- `aironet_1810_firmware`\n- `aironet_1810w_firmware`\n- `aironet_1815_firmware`\n- `aironet_1815i_firmware`\n- `aironet_1832_firmware`\n- `aironet_1842_firmware`\n- `aironet_1852_firmware`\n- `aironet_2702_firmware`\n- `aironet_2800_firmware`\n- `aironet_2800e_firmware`\n- `aironet_2800i_firmware`\n- `aironet_3702_firmware`\n- `aironet_3800_firmware`\n- `aironet_3800e_firmware`\n- `aironet_3800i_firmware`\n- `aironet_3800p_firmware`\n- `aironet_4800_firmware`\n- `aironet_ap803_firmware`\n- `aironet_iw3702_firmware`\n- `catalyst_9105_firmware`\n- `catalyst_9105axi_firmware`\n- `catalyst_9105axw_firmware`\n- `catalyst_9115_firmware`\n- `catalyst_9115_ap_firmware`\n- `catalyst_9115axe_firmware`\n- `catalyst_9115axi_firmware`\n- `catalyst_9117_firmware`\n- `catalyst_9117_ap_firmware`\n- `catalyst_9117axi_firmware`\n- `catalyst_9120_firmware`\n- `catalyst_9120_ap_firmware`\n- `catalyst_9120axe_firmware`\n- `catalyst_9120axi_firmware`\n- `catalyst_9120axp_firmware`\n- `catalyst_9124_firmware`\n- `catalyst_9124axd_firmware`\n- `catalyst_9124axi_firmware`\n- `catalyst_9130_firmware`\n- `catalyst_9130_ap_firmware`\n- `catalyst_9130axe_firmware`\n- `catalyst_9130axi_firmware`\n\n## Remediation\n\nRefer to the linked advisories for vendor-supplied fixes and affected version ranges.","depth":"sunlit","depthScore":36,"depthScoreParts":{"impact":35.8,"likelihood":0.6,"exploitation":0,"ransomware":0},"changes":[]}