CVSS: 8.0EPSS: 0%CPEs: 4EXPL: 1CVE-2020-27302
https://notcve.org/view.php?id=CVE-2020-27302
04 Jun 2021 — A stack buffer overflow in Realtek RTL8710 (and other Ameba-based devices) can lead to remote code execution via the "memcpy" function, when an attacker in Wi-Fi range sends a crafted "Encrypted GTK" value as part of the WPA2 4-way-handshake. Un desbordamiento del búfer de la pila en el Realtek RTL8710 (y otros dispositivos basados en Ameba) puede conllevar a una ejecución de código remota por medio de la función "memcpy", cuando un atacante en el rango de la Wi-Fi envía un valor "Encrypted GTK" diseñado co... • https://www.vdoo.com/blog/realtek-wifi-vulnerabilities-zero-day • CWE-787: Out-of-bounds Write •
CVSS: 8.0EPSS: 1%CPEs: 4EXPL: 2CVE-2020-27301
https://notcve.org/view.php?id=CVE-2020-27301
04 Jun 2021 — A stack buffer overflow in Realtek RTL8710 (and other Ameba-based devices) can lead to remote code execution via the "AES_UnWRAP" function, when an attacker in Wi-Fi range sends a crafted "Encrypted GTK" value as part of the WPA2 4-way-handshake. Un desbordamiento del búfer de la pila en Realtek RTL8710 (y otros dispositivos basados en Ameba) puede conllevar a una ejecución de código remota por medio de la función "AES_UnWRAP", cuando un atacante en el alcance del Wi-Fi envía un valor "Encrypted GTK" diseña... • https://github.com/chertoGUN/CVE-2020-27301-hostapd • CWE-787: Out-of-bounds Write •
CVSS: 7.5EPSS: 0%CPEs: 2EXPL: 1CVE-2020-25853
https://notcve.org/view.php?id=CVE-2020-25853
03 Feb 2021 — The function CheckMic() in the Realtek RTL8195A Wi-Fi Module prior to versions released in April 2020 (up to and excluding 2.08) does not validate the size parameter for an internal function, _rt_md5_hmac_veneer() or _rt_hmac_sha1_veneer(), resulting in a stack buffer over-read which can be exploited for denial of service. An attacker can impersonate an Access Point and attack a vulnerable Wi-Fi client, by injecting a crafted packet into the WPA2 handshake. The attacker does not need to know the network's P... • https://www.vdoo.com/blog/realtek-rtl8195a-vulnerabilities-discovered • CWE-125: Out-of-bounds Read CWE-126: Buffer Over-read •
CVSS: 8.1EPSS: 1%CPEs: 2EXPL: 1CVE-2020-25854
https://notcve.org/view.php?id=CVE-2020-25854
03 Feb 2021 — The function DecWPA2KeyData() in the Realtek RTL8195A Wi-Fi Module prior to versions released in April 2020 (up to and excluding 2.08) does not validate the size parameter for an internal function, rt_arc4_crypt_veneer() or _AES_UnWRAP_veneer(), resulting in a stack buffer overflow which can be exploited for remote code execution or denial of service. An attacker can impersonate an Access Point and attack a vulnerable Wi-Fi client, by injecting a crafted packet into the WPA2 handshake. The attacker needs to... • https://www.vdoo.com/blog/realtek-rtl8195a-vulnerabilities-discovered • CWE-121: Stack-based Buffer Overflow CWE-787: Out-of-bounds Write •
CVSS: 8.1EPSS: 1%CPEs: 2EXPL: 1CVE-2020-25855
https://notcve.org/view.php?id=CVE-2020-25855
03 Feb 2021 — The function AES_UnWRAP() in the Realtek RTL8195A Wi-Fi Module prior to versions released in April 2020 (up to and excluding 2.08) does not validate the size parameter for a memcpy() operation, resulting in a stack buffer overflow which can be exploited for remote code execution or denial of service. An attacker can impersonate an Access Point and attack a vulnerable Wi-Fi client, by injecting a crafted packet into the WPA2 handshake. The attacker needs to know the network's PSK in order to exploit this. La... • https://www.vdoo.com/blog/realtek-rtl8195a-vulnerabilities-discovered • CWE-121: Stack-based Buffer Overflow CWE-787: Out-of-bounds Write •
CVSS: 8.1EPSS: 1%CPEs: 2EXPL: 1CVE-2020-25856
https://notcve.org/view.php?id=CVE-2020-25856
03 Feb 2021 — The function DecWPA2KeyData() in the Realtek RTL8195A Wi-Fi Module prior to versions released in April 2020 (up to and excluding 2.08) does not validate the size parameter for an rtl_memcpy() operation, resulting in a stack buffer overflow which can be exploited for remote code execution or denial of service. An attacker can impersonate an Access Point and attack a vulnerable Wi-Fi client, by injecting a crafted packet into the WPA2 handshake. The attacker needs to know the network's PSK in order to exploit... • https://www.vdoo.com/blog/realtek-rtl8195a-vulnerabilities-discovered • CWE-121: Stack-based Buffer Overflow CWE-787: Out-of-bounds Write •
CVSS: 7.5EPSS: 0%CPEs: 2EXPL: 1CVE-2020-25857
https://notcve.org/view.php?id=CVE-2020-25857
03 Feb 2021 — The function ClientEAPOLKeyRecvd() in the Realtek RTL8195A Wi-Fi Module prior to versions released in April 2020 (up to and excluding 2.08) does not validate the size parameter for an rtl_memcpy() operation, resulting in a stack buffer overflow which can be exploited for denial of service. An attacker can impersonate an Access Point and attack a vulnerable Wi-Fi client, by injecting a crafted packet into the WPA2 handshake. The attacker does not need to know the network's PSK. La función ClientEAPOLKeyRecvd... • https://www.vdoo.com/blog/realtek-rtl8195a-vulnerabilities-discovered • CWE-121: Stack-based Buffer Overflow CWE-787: Out-of-bounds Write •