1. 首頁
  2. Support Overview
  3. Security Advisories
  4. Zyxel security advisory for FragAttacks against WiFi products

Zyxel security advisory for FragAttacks against WiFi products

CVE: CVE-2020-26139, CVE-2020-26140, CVE-2020-26141, CVE-2020-26142, CVE-2020-26143, CVE-2020-26144, CVE-2020-26145, CVE-2020-26146, CVE-2020-26147, CVE-2020-24586, CVE-2020-24587, CVE-2020-24588

Summary

Zyxel is aware of the FRagmentation and AGgregation Attacks against WiFi vulnerability (dubbed “FragAttacks”) and is releasing patches for some vulnerable WiFi products. Users are advised to adopt the applicable firmware updates or follow the advice below for optimal protection.

 

What is the vulnerability?

The FragAttacks vulnerability was identified in the IEEE 802.11 implementation of de-aggregation and de-fragmentation of frames at the receiver in some WiFi devices. There are twelve CVEs reported by Wi-Fi Alliance®, namely:

  • CVE-2020-26139: Forwarding EAPOL frames even though the sender is not yet authenticated (should only affect APs).
  • CVE-2020-26140: Accepting plaintext data frames in a protected network.
  • CVE-2020-26141: Not verifying the TKIP MIC of fragmented frames.
  • CVE-2020-26142: Processing fragmented frames as full frames.
  • CVE-2020-26143: Accepting fragmented plaintext data frames in a protected network.
  • CVE-2020-26144: Accepting plaintext A-MSDU frames that start with an RFC1042 header with EtherType EAPOL (in an encrypted network).
  • CVE-2020-26145: Accepting plaintext broadcast fragments as full frames (in an encrypted network).
  • CVE-2020-26146: Reassembling encrypted fragments with non-consecutive packet numbers.
  • CVE-2020-26147: Reassembling mixed encrypted/plaintext fragments.
  • CVE-2020-24586: Not clearing fragments from memory when (re)connecting to a network
  • CVE-2020-24587: Reassembling fragments encrypted under different keys
  • CVE-2020-24588: Accepting non-SPP A-MSDU frames

Please refer to the official CVEs for the technical details and severity.

It is important to note that exploiting these weaknesses is not a trivial task. Specifically, an attacker has to be physically within the wireless range of the vulnerable device, obtain a man-in-the-middle position, and entice user interaction to get the user to click or visit a compromised website. According to Wi-Fi Alliance®, there is currently no evidence of the vulnerabilities being used maliciously against WiFi users.

 

What versions are vulnerable—and what should you do?

After a thorough investigation, we’ve identified the affected products that are within their warranty and support period, as shown in the link here. We are already working with WiFi chip vendors to prepare the patches and will continue to update the advisory as additional information becomes available. We encourage users to install the applicable updates when available for optimal protection.

Please note that the table in the link provided does NOT include customized models for internet service providers (ISPs).

If you are an ISP, please contact your Zyxel sales or service representative for further details.

If you are an end-user who received your Zyxel device from an ISP, please reach out to the ISP’s support team directly, as the device may have custom-built settings.

If you are an end-user who purchased your Zyxel device yourself, please contact your local Zyxel support team or visit our forum for further assistance.

For those vulnerable products with chips and drivers no longer supported by WiFi chip vendors, we recommend that users take the following general security practices or upgrade their devices to a patched model.

1. Always use HTTPS to connect to websites and be aware of suspicious links

2. Do not connect to unprotected public WiFi networks.

3. Enable firewall rules on the affected device or its connected gateway/firewall, if any.

4. Enable WPA3-Enterprise to protect your WiFi network, if supported.

5. Use EAP-TLS, PEAP, or TTLS to authenticate a user’s identity, if supported.

6. Enable firewall rules on the affected device or its connected gateway/firewall, if any.

 

Got a question?

Please contact your local service rep or visit Zyxel’s forum for further information or assistance.

 

Revision history

2021-5-12: Initial release
2021-5-17: Updated the vulnerability description, general security practices, and the patch plan of CPE
2021-6-11: Updated the vulnerability description and the affected model list and patch plan of CPE, WiFi system and firewalls
2021-8-4: Updated the patch plan of access points as we’re still seeking support from our chip vendor.
2021-8-19: Updated the patch plan of firewalls, ONTs, home routers, and wireless extenders.
2021-9-1: Updated the patch plan of WiFi system, home routers, and wireless extenders
2021-11-9: Updated the patch plan of access points, CPE, ONTs, WiFi system, and wireless extender
2022-3-4: Updated the patch plan of 5G NR/4G LTE CPE and corrected the affected model list