1/3Security AdvisoryTitleSecurity Advisory for WFA vulnerabilityIssue Date2023/08/25Advisory NumberAR2021-003Serial NumberCVE-2020-24586CVE-2020-24587CVE-2020-24588CVE-2020-26146CVE-2020-26147VersionV1.1Issue SummaryRecently, the research paper “Fragment and Forge: Breaking Wi-Fi Through FrameAggregation and Fragmentation” by Mathy Vanhoef disclosed a collection of securityvulnerabilities that affect Wi-Fi devices. Three of these vulnerabilities are design flawsin the standard, while other nine are implementation vulnerabilities. More details aboutthese vulnerabilities can be found here.The following vulnerabilities have been found to affect Espressif devices: Wi-Fi design flaws：1) CVE-2020-24586: Fragment cache attack (not clearing fragments frommemory when (re)connecting to a network).2) CVE-2020-24587: Mixed key attack (reassembling fragments encryptedunder different keys).3) CVE-2020-24588: Aggregation attack (accepting non-SPP A-MSDUframes). Wi-Fi implementation vulnerabilities:1) CVE-2020-26146: Reassembling encrypted fragments with non-consecutivepacket numbers.2) CVE-2020-26147: Reassembling mixed encrypted/plaintext fragments. 2/3An attacker can use these vulnerabilities for the purpose of leaking information andexfiltration. To exploit these vulnerabilities, successful orchestration of injecting802.11 packets, MITM attack and redirection to malicious server hosted by theattacker is required. Executing such combination in practice is difficult to achieve.Note that the attacks do not allow the attacker to bypass network layer protectionssuch as TLS.Espressif thanks Dr Mathy Vanhoef for following a responsible disclosure process.Patched Versions of ESP-IDFESP-IDF BranchFixed ESP-IDF VersionCommit ID with the FixmasterNAef127ab9release/v4.3v4.3.146144f70release/v4.2v4.2.360ccb3ferelease/v4.1v4.1.297c8be71release/v4.0v4.0.47504329erelease/v3.3v3.3.6b403b0dbPatched Versions of ESP8266 SDKESP8266 SDK BranchCommit ID with the Fixmaster08e225ddrelease/v3.4967752e2Recommendations for Espressif Wi-Fi DevicesIf your firmware application makes use of network transport layer security such asTLS, the immediate impact is low. This should also include use of HTTPS forconnecting to any websites. Use of PMF(802.11w), WPA3 and EAP-TLS, if present,should further enhance security and prevent against MITM attacks. However, youshould immediately update to the latest stable ESP-IDF or SDK bugfix release once itis available.If your firmware application does not use network transport layer security featuressuch as TLS to protect important data or does not use latest Wi-Fi security protocolssuch as PMF/WPA3, you should consider urgently updating to a pre-release ESP-IDFor SDK version or updating to the latest stable release version. 3/3Audit all firmware applications to make sure any sensitive data is transferred usingTLS or similar protocols and to verify that TLS is correctly configured.Audit all firmware applications to make sure that unknown websites are not navigatedby any means and HTTPS is used to connect to the websites.Revision HistoryDateVersionRelease notes2023/08/25V1.11. Separate AR2021-003 as EN & CN version.2. Update information in chapterIssue Summary, PatchedVersions of ESP-IDF and Patched Versions of ESP8266 SDK.2021/06/25V1.0Initial release.