CVE-2020-25854: Buffer Overflow
The function DecWPA2KeyData() in the Realtek RTL8195A Wi-Fi Module prior to versions released in April 2020 (up to and excluding 2.08) does not validate the size parameter for an internal function, rtarc4cryptveneer() or AESUnWRAPveneer(), resulting in a stack buffer overflow which can be exploited for remote code execution or denial of service. An attacker can impersonate an Access Point and attack a vulnerable Wi-Fi client, by injecting a crafted packet into the WPA2 handshake. The attacker needs to know the network's PSK in order to exploit this.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2020-25854?
The severity of CVE-2020-25854 is high with a CVSS score of 8.1.
Which software is affected by CVE-2020-25854?
The Realtek RTL8195A Wi-Fi Module firmware versions up to and excluding 2.08 are affected by CVE-2020-25854.
What is the vulnerability in CVE-2020-25854?
CVE-2020-25854 is a stack buffer overflow vulnerability in the function DecWPA2KeyData() in the Realtek RTL8195A Wi-Fi Module firmware.
How can the stack buffer overflow vulnerability in CVE-2020-25854 be exploited?
The stack buffer overflow vulnerability in CVE-2020-25854 can be exploited by not validating the size parameter for internal functions, resulting in an overflow that can be exploited.
Is there a fix available for CVE-2020-25854?
Yes, versions released in April 2020 and onwards (excluding 2.08) have addressed the vulnerability in the Realtek RTL8195A Wi-Fi Module firmware.