CVE-2020-24588

CVE-2020-24588 is a vulnerability within the 802.11 Wi-Fi standard, affecting WPA, WPA2, WPA3, and WEP, that allows an unauthenticated attacker to inject arbitrary network packets. This flaw stems from the lack of authentication for the A-MSDU flag in the plaintext QoS header, impacting a wide range of vendors including Arista, Cisco, Debian, Intel, Linux, Microsoft, and Siemens. With a CVSS score of 3.5 (LOW), the vulnerability requires an adjacent network attacker and user interaction, but its impact is limited to low integrity. While the FAUCET Risk Score is 8/100, indicating low overall risk, its presence in a fundamental Wi-Fi standard makes it noteworthy. Despite its foundational nature, there is no evidence of active exploitation, nor are there publicly available exploits in Metasploit, Nuclei, or ExploitDB. However, the vulnerability has garnered significant community attention with three mentions and three media articles, primarily due to its association with the broader "FragAttacks" suite of vulnerabilities.