{"id":"CVE-2020-26144","title":"An issue was discovered on Samsung Galaxy S3 i9305 4.4.4 devices","summary":"An issue was discovered on Samsung Galaxy S3 i9305 4.4.4 devices. The WEP, WPA, WPA2, and WPA3 implementations accept plaintext A-MSDU frames as long as the first 8 bytes correspond to a valid RFC1042 (i.e., LLC/SNAP) header for EAPOL. A…","severity":"medium","cvss":6.5,"cvssVector":"CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N","cwe":["CWE-20"],"vendor":"samsung","product":"galaxy_i9305_firmware","affected":["galaxy_i9305_firmware = 4.4.4","c-250_firmware < 10.0.1-31","c-260_firmware < 10.0.1-31","c-230_firmware < 10.0.1-31","c-235_firmware < 10.0.1-31","c-200_firmware < 11.0.0-36","c-120_firmware < 11.0.0-36","c-130_firmware < 11.0.0-36","c-100_firmware < 11.0.0-36","c-110_firmware < 11.0.0-36","o-105_firmware < 11.0.0-36","w-118_firmware < 11.0.0-36","c-75_firmware","o-90_firmware","c-65_firmware","w-68_firmware","scalance_w700_ieee_802.11ax_firmware","scalance_w700_ieee_802.11n_firmware"],"patched":["c-250_firmware 10.0.1-31","c-260_firmware 10.0.1-31","c-230_firmware 10.0.1-31","c-235_firmware 10.0.1-31","c-200_firmware 11.0.0-36","c-120_firmware 11.0.0-36","c-130_firmware 11.0.0-36","c-100_firmware 11.0.0-36","c-110_firmware 11.0.0-36","o-105_firmware 11.0.0-36","w-118_firmware 11.0.0-36"],"published":"2021-05-11","updated":"2026-10-08","sourceUpdated":"2026-10-08T22:16:58.710","source":"NVD","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2020-26144","references":[{"url":"http://www.openwall.com/lists/oss-security/2021/05/11/12","label":"cve@mitre.org"},{"url":"https://cert-portal.siemens.com/productcert/pdf/ssa-913875.pdf","label":"cve@mitre.org"},{"url":"https://github.com/vanhoefm/fragattacks/blob/master/SUMMARY.md","label":"cve@mitre.org"},{"url":"https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-wifi-faf-22epcEWu","label":"cve@mitre.org"},{"url":"https://www.arista.com/en/support/advisories-notices/security-advisories/12602-security-advisory-63","label":"cve@mitre.org"},{"url":"https://www.fragattacks.com","label":"cve@mitre.org"},{"url":"http://www.openwall.com/lists/oss-security/2021/05/11/12","label":"af854a3a-2127-422b-91ae-364da2661108"},{"url":"https://cert-portal.siemens.com/productcert/pdf/ssa-913875.pdf","label":"af854a3a-2127-422b-91ae-364da2661108"},{"url":"https://github.com/vanhoefm/fragattacks/blob/master/SUMMARY.md","label":"af854a3a-2127-422b-91ae-364da2661108"},{"url":"https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-wifi-faf-22epcEWu","label":"af854a3a-2127-422b-91ae-364da2661108"},{"url":"https://www.arista.com/en/support/advisories-notices/security-advisories/12602-security-advisory-63","label":"af854a3a-2127-422b-91ae-364da2661108"},{"url":"https://www.fragattacks.com","label":"af854a3a-2127-422b-91ae-364da2661108"},{"url":"https://cert-portal.siemens.com/productcert/html/ssa-019200.html","label":"0b142b55-0307-4c5a-b3c9-f314f3fb7c5e"},{"url":"https://cert-portal.siemens.com/productcert/html/ssa-913875.html","label":"0b142b55-0307-4c5a-b3c9-f314f3fb7c5e"}],"tags":["nvd"],"epss":0.04913,"epssPercentile":0.91911,"ingestedAt":"2026-10-08T23:16:47.319Z","slug":"CVE-2020-26144","body":"## Overview\n\nAn issue was discovered on Samsung Galaxy S3 i9305 4.4.4 devices. The WEP, WPA, WPA2, and WPA3 implementations accept plaintext A-MSDU frames as long as the first 8 bytes correspond to a valid RFC1042 (i.e., LLC/SNAP) header for EAPOL. An adversary can abuse this to inject arbitrary network packets independent of the network configuration.\n\n## Affected\n\n- `galaxy_i9305_firmware = 4.4.4`\n- `c-250_firmware < 10.0.1-31`\n- `c-260_firmware < 10.0.1-31`\n- `c-230_firmware < 10.0.1-31`\n- `c-235_firmware < 10.0.1-31`\n- `c-200_firmware < 11.0.0-36`\n- `c-120_firmware < 11.0.0-36`\n- `c-130_firmware < 11.0.0-36`\n- `c-100_firmware < 11.0.0-36`\n- `c-110_firmware < 11.0.0-36`\n- `o-105_firmware < 11.0.0-36`\n- `w-118_firmware < 11.0.0-36`\n- `c-75_firmware`\n- `o-90_firmware`\n- `c-65_firmware`\n- `w-68_firmware`\n- `scalance_w700_ieee_802.11ax_firmware`\n- `scalance_w700_ieee_802.11n_firmware`\n\n## Remediation\n\nUpgrade past the affected range:\n\n- `c-250_firmware 10.0.1-31`\n- `c-260_firmware 10.0.1-31`\n- `c-230_firmware 10.0.1-31`\n- `c-235_firmware 10.0.1-31`\n- `c-200_firmware 11.0.0-36`\n- `c-120_firmware 11.0.0-36`\n- `c-130_firmware 11.0.0-36`\n- `c-100_firmware 11.0.0-36`\n- `c-110_firmware 11.0.0-36`\n- `o-105_firmware 11.0.0-36`\n- `w-118_firmware 11.0.0-36`","depth":"sunlit","depthScore":37,"depthScoreParts":{"impact":35.8,"likelihood":1,"exploitation":0,"ransomware":0},"changes":[]}