Predictive Vulnerability Intelligence.

Product

  • Product
  • Pricing
  • Documentation

Company

  • About
  • Partnerships
  • Blog
  • Support

Legal

  • Terms
  • Privacy
  • Data Licensing

© 2026 FAUCET Technologies LLC. All rights reserved.

CVE-2020-24587

14
FAUCET Score

CVE-2020-24587 is a low-severity vulnerability affecting Wi-Fi standards (WPA, WPA2, WPA3, WEP) and various products including Arista, Cisco, Debian, Intel, and Linux. It stems from the 802.11 standard not requiring consistent encryption keys across all frame fragments, allowing an adversary to decrypt selected fragments when keys are renewed. The attack requires adjacent access and user interaction, with a potential impact of low confidentiality. There is no evidence of active exploitation, public exploit code, or inclusion in the KEV catalog, though it has received some community and media attention.

Impacted Technologies

VendorProductVersion(s)CPE
All Versions ImpactedCPE matchmatch criteria
cpe:2.3:a:ieee:ieee_802.11:*:*:*:*:*:*:*:*
Range not provided by sourceCPE matchmatch criteria
cpe:2.3:a:linux:mac80211:-:*:*:*:*:*:*:*
9.0CPE matchmatch criteria
cpe:2.3:o:debian:debian_linux:9.0:*:*:*:*:*:*:*
Range not provided by sourceCPE matchmatch criteria
cpe:2.3:o:arista:c-100_firmware:-:*:*:*:*:*:*:*
Range not provided by sourceCPE matchmatch criteria
cpe:2.3:o:arista:c-110_firmware:-:*:*:*:*:*:*:*

CVSS Data

CVSS version used by this source: 3.1

2.6LOW

CVSS:3.1/AV:A/AC:H/PR:N/UI:R/S:U/C:L/I:N/A:N

Attack Vector
ADJACENT_NETWORK
Attack Complexity
HIGH
Privileges Required
NONE
User Interaction
REQUIRED
Scope
UNCHANGED
Confidentiality Impact
LOW
Integrity Impact
NONE
Availability Impact
NONE
Exploitability Score
1.2
Impact Score
1.4
CvssVersion
3.1

Exploit Intelligence

EPSS Score
2.59%
Probability of exploitation in next 30 days
EPSS Percentile
83.7%
Percentile rank of EPSS score among Peer Group
As of 2026-07-26
Model: v2026.06.15
This CVE's current EPSS score of 0.0259 is in the 100th percentile among its peer group of 6 CVEs.

Social Chatter

The average CVE in this peer group has 0.0 Twitter, 0.2 Reddit, 0.0 Bluesky, 0.0 Mastodon, and 0.0 GitHub mentions.

Media Mentions

The average CVE in this peer group has 0.8 InfoSec Media, 0.0 Vendor Blog, and 0.0 Security Researcher mentions.

Remediation

Patch Available

Vendor Patches (47)

microsoftpatch availablevia msrc
Product: Windows 10 Version 20H2 for ARM64-based SystemsFixed in: 10.0.19042.982
View patch
microsoftpatch availablevia msrc
Product: Windows Server 2012 (Server Core installation)Fixed in: 6.2.9200.23347
View patch
microsoftpatch availablevia msrc
Product: Windows 10 Version 20H2 for 32-bit SystemsFixed in: 10.0.19042.982
View patch
microsoftpatch availablevia msrc
Product: Windows Server, version 20H2 (Server Core Installation)Fixed in: 10.0.19042.982
View patch
microsoftpatch availablevia msrc
Product: Windows 10 Version 1803 for 32-bit SystemsFixed in: 10.0.17134.2207
View patch
microsoftpatch availablevia msrc
Product: Windows 10 Version 1803 for x64-based SystemsFixed in: 10.0.17134.2207
View patch
microsoftpatch availablevia msrc
Product: Windows 10 Version 1803 for ARM64-based SystemsFixed in: 10.0.17134.2207
View patch
microsoftpatch availablevia msrc
Product: Windows 10 Version 1809 for 32-bit SystemsFixed in: 10.0.17763.1935
View patch
microsoftpatch availablevia msrc
Product: Windows 10 Version 1809 for x64-based SystemsFixed in: 10.0.17763.1935
View patch
microsoftpatch availablevia msrc
Product: Windows 10 Version 1809 for ARM64-based SystemsFixed in: 10.0.17763.1935
View patch
microsoftpatch availablevia msrc
Product: Windows Server 2019Fixed in: 10.0.17763.1935
View patch
microsoftpatch availablevia msrc
Product: Windows Server 2019 (Server Core installation)Fixed in: 10.0.17763.1935
View patch
microsoftpatch availablevia msrc
Product: Windows 10 Version 1909 for 32-bit SystemsFixed in: 10.0.18363.1556
View patch
microsoftpatch availablevia msrc
Product: Windows 10 Version 1909 for x64-based SystemsFixed in: 10.0.18363.1556
View patch
microsoftpatch availablevia msrc
Product: Windows 10 Version 1909 for ARM64-based SystemsFixed in: 10.0.18363.1556
View patch
microsoftpatch availablevia msrc
Product: Windows Server, version 1909 (Server Core installation)Fixed in: 10.0.18363.1556
View patch
microsoftpatch availablevia msrc
Product: Windows 10 Version 2004 for 32-bit SystemsFixed in: 10.0.19041.982
View patch
microsoftpatch availablevia msrc
Product: Windows 10 Version 2004 for ARM64-based SystemsFixed in: 10.0.19041.982
View patch
microsoftpatch availablevia msrc
Product: Windows 10 Version 2004 for x64-based SystemsFixed in: 10.0.19041.982
View patch
microsoftpatch availablevia msrc
Product: Windows Server, version 2004 (Server Core installation)Fixed in: 10.0.19041.982
View patch
microsoftpatch availablevia msrc
Product: Windows 10 for 32-bit SystemsFixed in: 10.0.10240.18931
View patch
microsoftpatch availablevia msrc
Product: Windows 10 for x64-based SystemsFixed in: 10.0.10240.18931
View patch
microsoftpatch availablevia msrc
Product: Windows 10 Version 1607 for 32-bit SystemsFixed in: 10.0.14393.4401
View patch
microsoftpatch availablevia msrc
Product: Windows 10 Version 1607 for x64-based SystemsFixed in: 10.0.14393.4401
View patch
microsoftpatch availablevia msrc
Product: Windows Server 2016Fixed in: 10.0.14393.4401
View patch
microsoftpatch availablevia msrc
Product: Windows Server 2016 (Server Core installation)Fixed in: 10.0.14393.4401
View patch
microsoftpatch availablevia msrc
Product: Windows 7 for 32-bit Systems Service Pack 1Fixed in: 6.1.7601.24597
View patch
microsoftpatch availablevia msrc
Product: Windows 7 for x64-based Systems Service Pack 1Fixed in: 6.1.7601.24597
View patch
microsoftpatch availablevia msrc
Product: Windows Server 2008 R2 for x64-based Systems Service Pack 1Fixed in: 6.1.7601.24597
View patch
microsoftpatch availablevia msrc
Product: Windows Server 2008 R2 for x64-based Systems Service Pack 1 (Server Core installation)Fixed in: 6.1.7601.24597
View patch
microsoftpatch availablevia msrc
Product: Windows 7 for 32-bit Systems Service Pack 1Fixed in: 6.1.7601.24598
View patch
microsoftpatch availablevia msrc
Product: Windows 7 for x64-based Systems Service Pack 1Fixed in: 6.1.7601.24598
View patch
microsoftpatch availablevia msrc
Product: Windows Server 2008 R2 for x64-based Systems Service Pack 1Fixed in: 6.1.7601.24598
View patch
microsoftpatch availablevia msrc
Product: Windows Server 2008 R2 for x64-based Systems Service Pack 1 (Server Core installation)Fixed in: 6.1.7601.24598
View patch
microsoftpatch availablevia msrc
Product: Windows Server 2012 R2Fixed in: 6.3.9600.20017
View patch
microsoftpatch availablevia msrc
Product: Windows Server 2012 R2 (Server Core installation)Fixed in: 6.3.9600.20017
View patch
microsoftpatch availablevia msrc
Product: Windows 8.1 for 32-bit systemsFixed in: 6.3.9600.20017
View patch
microsoftpatch availablevia msrc
Product: Windows 8.1 for x64-based systemsFixed in: 6.3.9600.20017
View patch
microsoftpatch availablevia msrc
Product: Windows RT 8.1Fixed in: 6.3.9600.20017
microsoftpatch availablevia msrc
Product: Windows Server 2008 for 32-bit Systems Service Pack 2Fixed in: 6.0.6003.21117
View patch
microsoftpatch availablevia msrc
Product: Windows Server 2008 for 32-bit Systems Service Pack 2 (Server Core installation)Fixed in: 6.0.6003.21117
View patch
microsoftpatch availablevia msrc
Product: Windows Server 2008 for x64-based Systems Service Pack 2Fixed in: 6.0.6003.21117
View patch
microsoftpatch availablevia msrc
Product: Windows Server 2008 for x64-based Systems Service Pack 2 (Server Core installation)Fixed in: 6.0.6003.21117
View patch
microsoftpatch availablevia msrc
Product: Windows Server 2012Fixed in: 6.2.9200.23347
View patch
redhatpatch availablevia redhat_api
Product: Red Hat Enterprise Linux 8Fixed in: kernel-0:4.18.0-348.el8
View patch
redhatpatch availablevia redhat_api
Product: Red Hat Enterprise Linux 8Fixed in: kernel-rt-0:4.18.0-348.rt7.130.el8
View patch
redhatend of lifevia redhat_api
Product: Red Hat Enterprise Linux 7Fixed in: kernel-alt

Vendor Advisories (2)

redhatCVE-2020-24587Moderate

kernel: Reassembling fragments encrypted under different keys

May 11, 2021
microsoft2021-May/CVE-2020-24587Important

Windows Wireless Networking Information Disclosure Vulnerability

May 11, 2021

References

github.com / vanhoefm/fragattacks/blob/master/SUMMARY.md
Third Party Advisory
lists.debian.org / debian-lts-announce/2021/06/msg00019.html
Mailing ListThird Party Advisory
lists.debian.org / debian-lts-announce/2021/06/msg00020.html
Mailing ListThird Party Advisory
lists.debian.org / debian-lts-announce/2023/04/msg00002.html
tools.cisco.com / security/center/content/CiscoSecurityAdvisory/cisco-sa-wifi-faf-22epcEWu
Third Party Advisory
arista.com / en/support/advisories-notices/security-advisories/12602-security-advisory-63
Third Party Advisory
fragattacks.com
ExploitThird Party Advisory
intel.com / content/www/us/en/security-center/advisory/intel-sa-00473.html
Third Party Advisory
openwall.com / lists/oss-security/2021/05/11/12
Mailing ListThird Party Advisory