CVE-2020-24587: arista c-100_firmware
Vulnerability summary
CVE-2020-24587 is a low (CVSS 2.6) vulnerability in arista c-100_firmware. EPSS estimates a 2.59% chance of exploitation in the next 30 days, higher than 85.3% of scored vulnerabilities. 1 public exploit is recorded.
Not severe (CVSS 2.6, adjacent network); no exploitation reported by the 5 checked sources
Source freshness unavailable
How is this decided?Advisory lineage
Upstream 0 · Downstream 33 · Related 26Timeline
- 11-05-2021PublishedVulnerability first disclosed.
- 04-08-2024Last modifiedVulnerability information updated.
Description
The 802.11 standard that underpins Wi-Fi Protected Access (WPA, WPA2, and WPA3) and Wired Equivalent Privacy (WEP) doesn't require that all fragments of a frame are encrypted under the same key. An adversary can abuse this to decrypt selected fragments when another device sends fragmented frames and the WEP, CCMP, or GCMP encryption key is periodically renewed.
CVSS metrics
4 scores · 3 sources · 2 versions- OSV · UbuntuEcosystem advisory · calculated2.6LowCVSS:3.1/AV:A/AC:H/PR:N/UI:R/S:U/C:L/I:N/A:N
- OSV · DebianEcosystem advisory · calculated2.6LowCVSS:3.1/AV:A/AC:H/PR:N/UI:R/S:U/C:L/I:N/A:N
EPSS trend
Probability
2.59%
Chance of exploitation in the next 30 days
Percentile
85%
Versus all other CVEs
30-day change
No change 0.00 pp
From 2.59% on 04-10-2026
Known exploited
Compare KEV catalogs
CISA KEVNot in the CISA KEV catalog.
ENISA CNWNot in the ENISA CNW catalog.
CIRCLNot in the CIRCL catalog.
Public exploits
1 foundExploit Reference (fragattacks.com)
Maturity: unknown
Weaknesses
CWE · root causeAffected systems
Known conditions: adjacent network, no authentication, user interaction (CVSS vector). Other conditions: not stated in public data.
Cisco128 products
Ubuntu54 products
- linuxAll versions (No fix recorded) | < 4.15.0-151.157 | < 5.4.0-77.86
- linux-awsAll versions (No fix recorded) | < 4.15.0-1109.116 | < 5.4.0-1051.53
- linux-aws-5.0All versions (No fix recorded)
- linux-aws-5.3All versions (No fix recorded)
- linux-aws-5.4< 5.4.0-1051.53~18.04.1
Debian3 products
- firmware-nonfree< 20210818-1
- linux< 5.10.46-1
- debian_linuxEOL9.0
4 vendors · 200 products · Showing 200 of 223
References
20 links- www.intel.com/content/www/us/en/security-center/advisory/intel-sa-00473.htmlThird Party Advisory
- tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-wifi-faf-22epcEWuVendor AdvisoryThird Party Advisory
- github.com/vanhoefm/fragattacks/blob/master/SUMMARY.mdThird Party Advisory
