Unknown
CVE-2020-24587
CVE ID
AttackerKB requires a CVE ID in order to pull vulnerability data and references from the CVE list and the National Vulnerability Database. If available, please supply below:
Add References:
Unknown
(1 user assessed)Unknown
(1 user assessed)CVE-2020-24587
MITRE ATT&CK
Collection
Command and Control
Credential Access
Defense Evasion
Discovery
Execution
Exfiltration
Impact
Initial Access
Lateral Movement
Persistence
Privilege Escalation
Description
The 802.11 standard that underpins Wi-Fi Protected Access (WPA, WPA2, and WPA3) and Wired Equivalent Privacy (WEP) doesn’t require that all fragments of a frame are encrypted under the same key. An adversary can abuse this to decrypt selected fragments when another device sends fragmented frames and the WEP, CCMP, or GCMP encryption key is periodically renewed.
Add Assessment
Ratings
Technical Analysis
Attackers are able to sniff traffic from the incoming lan connection while using a MITM attack or a man in the browser attack. It seems more like a man in the lower attack because it will be as if two users are sending cmds to the same device at the same time. Over time what will happen is the attacker will lock down the access point, harden it then set your browser and internet access to a guest connection. You are able to login in to your router but not actually make changes.. For example I could logon to the router at 192.168.1.1 configure it then connect remotely to it and it would connect to the same port only the ip would be 162.244.6.18. The router of in use doesn’t have WIFI but has an AP controller. Anyone else come across this .please im all ears. Thanks!
Would you also like to delete your Exploited in the Wild Report?
Delete Assessment Only Delete Assessment and Exploited in the Wild ReportCVSS V3 Severity and Metrics
General Information
Exploited in the Wild
- Threat Feed
- News Article or Blog
- Personally observed in an environment
Would you like to delete this Exploited in the Wild Report?
Yes, delete this reportReferences
Advisory
Additional Info
Technical Analysis
Report as Exploited in the Wild
CVE ID
AttackerKB requires a CVE ID in order to pull vulnerability data and references from the CVE list and the National Vulnerability Database. If available, please supply below:
Hi @2020Cyberworld, thanks for the detailed assessment! I see you’ve reported a few vulns as exploited in the wild—are you seeing this and the other vulns you’ve reported used in active (not pen testing) attacks?