CVE-2020-26143 [Medium] | Input Validation Bypass in Awus036h Firmware

An issue was discovered in the ALFA Windows 10 driver 1030.36.604 for AWUS036ACH. The WEP, WPA, WPA2, and WPA3 implementations accept fragmented plaintext frames in a protected Wi-Fi network. An adversary can abuse this to inject arbitrary data frames independent of the network configuration.

#	Date	Old EPSS score	New EPSS score	Delta (New - Old)
1	2026-04-12	0.60%	0.40%	-0.20%
2	2026-03-04	0.25%	0.60%	+0.35%
3	2026-03-01	—	0.25%	—

Date

Old EPSS score

New EPSS score

Delta (New - Old)

2026-04-12

0.60%

0.40%

-0.20%

2026-03-04

0.25%

0.60%

+0.35%

2026-03-01

—

0.25%

—

Base score	Version	Severity	Vector	Exploitability	Impact	Score source
6.5	3.1	MEDIUM	`CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N` Click to expand Attack vector (AV:A) Attacker has to be nearby on the network—same office, same link, that vibe—not the whole wide internet. Attack complexity (AC:L) Once they can reach the bug, pulling it off is straightforward—no weird race conditions or rare setup. Privileges required (PR:N) No account or special rights needed—anonymous or random user is enough. User interaction (UI:N) Nobody has to click “OK” or open a trap file; it can work without a victim helping. Scope (S:U) Damage stays in the same “trust bubble” as the broken component—no big spill into unrelated systems. Confidentiality (C:N) Doesn’t really leak secrets in a meaningful way. Integrity (I:H) They could widely tamper with or forge data—trust in the data is badly hurt. Availability (A:N) Service keeps running; no real outage angle.	2.8	3.6	[email protected]
3.3	2.0	LOW	`AV:A/AC:L/Au:N/C:N/I:P/A:N` Click to expand Access vector (AV:A) Requires access to an adjacent network segment. Access complexity (AC:L) Exploitation conditions are straightforward and predictable. Authentication (AU:N) No authentication is required. Confidentiality impact (C:N) No confidentiality impact. Integrity impact (I:P) Partial integrity impact. Availability impact (A:N) No availability impact.	6.5	2.9	[email protected]

Base score

Version

Severity

Vector

Exploitability

Impact

Score source

6.5

3.1

MEDIUM

CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N Click to expand

Attack vector (AV:A): Attacker has to be nearby on the network—same office, same link, that vibe—not the whole wide internet.
Attack complexity (AC:L): Once they can reach the bug, pulling it off is straightforward—no weird race conditions or rare setup.
Privileges required (PR:N): No account or special rights needed—anonymous or random user is enough.
User interaction (UI:N): Nobody has to click “OK” or open a trap file; it can work without a victim helping.
Scope (S:U): Damage stays in the same “trust bubble” as the broken component—no big spill into unrelated systems.
Confidentiality (C:N): Doesn’t really leak secrets in a meaningful way.
Integrity (I:H): They could widely tamper with or forge data—trust in the data is badly hurt.
Availability (A:N): Service keeps running; no real outage angle.

2.8

3.6

[email protected]

3.3

2.0

LOW

AV:A/AC:L/Au:N/C:N/I:P/A:N Click to expand

Access vector (AV:A): Requires access to an adjacent network segment.
Access complexity (AC:L): Exploitation conditions are straightforward and predictable.
Authentication (AU:N): No authentication is required.
Confidentiality impact (C:N): No confidentiality impact.
Integrity impact (I:P): Partial integrity impact.
Availability impact (A:N): No availability impact.

6.5

2.9

[email protected]

OS Trackers for CVE-2020-26143

vendor	priority	summary	link
`redhat`	medium	—	https://access.redhat.com/security/cve/CVE-2020-26143
`suse`	high	CVE-2020-26143 severity important: SUSE including 32 source package names (bpftool-4.18.0-348.el8, kernel-4.18.0-348.el8, …), 81 product×package rows across 21 product lines (SUSE Liberty Linux 8, SUSE Linux Enterprise High Performance Computing 15-LTSS, … (21 product lines)): Known Not Affected 61, Fixed 20.	https://www.suse.com/security/cve/CVE-2020-26143/
`ubuntu`	medium	CVE-2020-26143 medium priority: Ubuntu including 168 source packages (linux, linux-allwinner, …), 2155 status rows across 16 suites (bionic, focal, groovy, hirsute, impish, jammy, kinetic, lunar, mantic, noble, oracular, plucky, questing, trusty, upstream, xenial): DNE 1686, ignored 307, needs-triage 162.	https://ubuntu.com/security/CVE-2020-26143

Affected software / configurations for CVE-2020-26143

Vendor	Product	Version	Raw CPE
alfa	awus036h_firmware	1030.36.604	cpe:2.3:o:alfa:awus036h_firmware:1030.36.604:::::windows_10::
arista	c-75_firmware	—	cpe:2.3:o:arista:c-75_firmware:-:::::::*
arista	o-90_firmware	—	cpe:2.3:o:arista:o-90_firmware:-:::::::*
arista	c-65_firmware	—	cpe:2.3:o:arista:c-65_firmware:-:::::::*
arista	w-68_firmware	—	cpe:2.3:o:arista:w-68_firmware:-:::::::*
siemens	scalance_w700_ieee_802.11n_firmware	—	cpe:2.3:o:siemens:scalance_w700_ieee_802.11n_firmware::::::::

References for CVE-2020-26143

URL	Tags
http://www.openwall.com/lists/oss-security/2021/05/11/12	Mailing List Third Party Advisory
https://cert-portal.siemens.com/productcert/pdf/ssa-913875.pdf	Third Party Advisory
https://github.com/vanhoefm/fragattacks/blob/master/SUMMARY.md	Third Party Advisory
https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-wifi-faf-22epcEWu	Third Party Advisory
https://www.arista.com/en/support/advisories-notices/security-advisories/12602-security-advisory-63	Third Party Advisory
https://www.fragattacks.com	Third Party Advisory
https://cert-portal.siemens.com/productcert/html/ssa-019200.html
https://cert-portal.siemens.com/productcert/html/ssa-913875.html

URL

CVE-2020-26143

Exploit prediction scoring system (EPSS) score for CVE-2020-26143

Common vulnerability scoring system (CVSS) metrics for CVE-2020-26143

Weakness enumeration for CVE-2020-26143

OS Trackers for CVE-2020-26143

Affected software / configurations for CVE-2020-26143

References for CVE-2020-26143