CVSS: 7.5EPSS: 0%CPEs: 2EXPL: 1CVE-2020-25853
https://notcve.org/view.php?id=CVE-2020-25853
03 Feb 2021 — The function CheckMic() in the Realtek RTL8195A Wi-Fi Module prior to versions released in April 2020 (up to and excluding 2.08) does not validate the size parameter for an internal function, _rt_md5_hmac_veneer() or _rt_hmac_sha1_veneer(), resulting in a stack buffer over-read which can be exploited for denial of service. An attacker can impersonate an Access Point and attack a vulnerable Wi-Fi client, by injecting a crafted packet into the WPA2 handshake. The attacker does not need to know the network's P... • https://www.vdoo.com/blog/realtek-rtl8195a-vulnerabilities-discovered • CWE-125: Out-of-bounds Read CWE-126: Buffer Over-read •
CVSS: 8.1EPSS: 1%CPEs: 2EXPL: 1CVE-2020-25854
https://notcve.org/view.php?id=CVE-2020-25854
03 Feb 2021 — The function DecWPA2KeyData() in the Realtek RTL8195A Wi-Fi Module prior to versions released in April 2020 (up to and excluding 2.08) does not validate the size parameter for an internal function, rt_arc4_crypt_veneer() or _AES_UnWRAP_veneer(), resulting in a stack buffer overflow which can be exploited for remote code execution or denial of service. An attacker can impersonate an Access Point and attack a vulnerable Wi-Fi client, by injecting a crafted packet into the WPA2 handshake. The attacker needs to... • https://www.vdoo.com/blog/realtek-rtl8195a-vulnerabilities-discovered • CWE-121: Stack-based Buffer Overflow CWE-787: Out-of-bounds Write •
CVSS: 8.1EPSS: 1%CPEs: 2EXPL: 1CVE-2020-25855
https://notcve.org/view.php?id=CVE-2020-25855
03 Feb 2021 — The function AES_UnWRAP() in the Realtek RTL8195A Wi-Fi Module prior to versions released in April 2020 (up to and excluding 2.08) does not validate the size parameter for a memcpy() operation, resulting in a stack buffer overflow which can be exploited for remote code execution or denial of service. An attacker can impersonate an Access Point and attack a vulnerable Wi-Fi client, by injecting a crafted packet into the WPA2 handshake. The attacker needs to know the network's PSK in order to exploit this. La... • https://www.vdoo.com/blog/realtek-rtl8195a-vulnerabilities-discovered • CWE-121: Stack-based Buffer Overflow CWE-787: Out-of-bounds Write •
CVSS: 8.1EPSS: 1%CPEs: 2EXPL: 1CVE-2020-25856
https://notcve.org/view.php?id=CVE-2020-25856
03 Feb 2021 — The function DecWPA2KeyData() in the Realtek RTL8195A Wi-Fi Module prior to versions released in April 2020 (up to and excluding 2.08) does not validate the size parameter for an rtl_memcpy() operation, resulting in a stack buffer overflow which can be exploited for remote code execution or denial of service. An attacker can impersonate an Access Point and attack a vulnerable Wi-Fi client, by injecting a crafted packet into the WPA2 handshake. The attacker needs to know the network's PSK in order to exploit... • https://www.vdoo.com/blog/realtek-rtl8195a-vulnerabilities-discovered • CWE-121: Stack-based Buffer Overflow CWE-787: Out-of-bounds Write •
CVSS: 7.5EPSS: 0%CPEs: 2EXPL: 1CVE-2020-25857
https://notcve.org/view.php?id=CVE-2020-25857
03 Feb 2021 — The function ClientEAPOLKeyRecvd() in the Realtek RTL8195A Wi-Fi Module prior to versions released in April 2020 (up to and excluding 2.08) does not validate the size parameter for an rtl_memcpy() operation, resulting in a stack buffer overflow which can be exploited for denial of service. An attacker can impersonate an Access Point and attack a vulnerable Wi-Fi client, by injecting a crafted packet into the WPA2 handshake. The attacker does not need to know the network's PSK. La función ClientEAPOLKeyRecvd... • https://www.vdoo.com/blog/realtek-rtl8195a-vulnerabilities-discovered • CWE-121: Stack-based Buffer Overflow CWE-787: Out-of-bounds Write •