CVE-2020-26139: arista c-100_firmware Improper Authentication
Vulnerability summary
CVE-2020-26139 is a medium (CVSS 5.3) Improper Authentication vulnerability in arista c-100_firmware. EPSS estimates a 6.49% chance of exploitation in the next 30 days, higher than 93.7% of scored vulnerabilities.
Not severe (CVSS 5.3, adjacent network); no exploitation reported by the 5 checked sources
Source freshness unavailable
How is this decided?Advisory lineage
Upstream 0 · Downstream 31 · Related 25Timeline
- 11-05-2021PublishedVulnerability first disclosed.
- 14-04-2026Last modifiedVulnerability information updated.
Description
An issue was discovered in the kernel in NetBSD 7.1. An Access Point (AP) forwards EAPOL frames to other clients even though the sender has not yet successfully authenticated to the AP. This might be abused in projected Wi-Fi networks to launch denial-of-service attacks against connected clients and makes it easier to exploit other vulnerabilities in connected clients.
CVSS metrics
4 scores · 3 sources · 2 versions- OSV · UbuntuEcosystem advisory · calculated5.3MediumCVSS:3.1/AV:A/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H
- OSV · DebianEcosystem advisory · calculated5.3MediumCVSS:3.1/AV:A/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H
EPSS trend
Probability
6.49%
Chance of exploitation in the next 30 days
Percentile
94%
Versus all other CVEs
30-day change
No change 0.00 pp
From 6.49% on 04-10-2026
Known exploited
Compare KEV catalogs
CISA KEVNot in the CISA KEV catalog.
ENISA CNWNot in the ENISA CNW catalog.
CIRCLNot in the CIRCL catalog.
Public exploits
0 foundNo public exploits indexed.
Weaknesses
CWE · root causeAffected systems
Known conditions: adjacent network, no authentication, no user interaction (CVSS vector). Other conditions: not stated in public data.
Cisco128 products
Ubuntu54 products
- linuxAll versions (No fix recorded) | < 4.4.0-222.255 | < 4.15.0-151.157 | < 5.4.0-77.86
- linux-aws< 4.4.0-1102.107 | < 4.4.0-1138.152 | < 4.15.0-1109.116 | < 5.4.0-1051.53
- linux-aws-5.0All versions (No fix recorded)
- linux-aws-5.3All versions (No fix recorded)
- linux-aws-5.4< 5.4.0-1051.53~18.04.1
Debian2 products
- linux< 5.10.46-1
- debian_linuxEOL9.0
Intel1 product
5 vendors · 200 products · Showing 200 of 221
References
22 links- tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-wifi-faf-22epcEWuVendor AdvisoryX Refsource CISCOThird Party Advisory
lists.debian.org/debian-lts-announce/2021/06/msg00020.htmlMailing ListX Refsource MLISTThird Party Advisory- lists.debian.org/debian-lts-announce/2021/06/msg00019.htmlMailing ListX Refsource MLISTThird Party Advisory
- www.arista.com/en/support/advisories-notices/security-advisories/12602-security-advisory-63X Refsource MISCThird Party Advisory