Network Packet Injection Vulnerability in Samsung Galaxy S3

CVE-2020-26144

Summary

A vulnerability has been identified in the Samsung Galaxy S3 i9305 4.4.4 devices where the wireless security protocols (WEP, WPA, WPA2, and WPA3) improperly handle plaintext A-MSDU frames. Specifically, as long as the initial 8 bytes match a valid RFC1042 LLC/SNAP header for EAPOL, an attacker can exploit this weakness to inject arbitrary network packets without needing the requisite network configuration. This can lead to various security issues, including unauthorized access to sensitive data and manipulation of network traffic. Users are encouraged to apply all relevant security updates to mitigate this risk.

References