CVE-2020-24586

What it actually does

The 802.11 standard fails to mandate clearing of received encrypted fragments from memory after network (re)connection, allowing an attacker to abuse uncleared fragments from prior WEP/CCMP/GCMP sessions to reassemble and inject arbitrary packets or exfiltrate data.

Why it matters to the business

Enables attackers on the same Wi-Fi network to inject malicious traffic or steal user data, potentially leading to unauthorized access, data leakage, or further network compromise with moderate urgency given public exploit availability and widespread hardware exposure.

How an attack unfolds

An attacker positions themselves on the same wireless network, sends specially crafted fragmented frames using WEP, CCMP, or GCMP encryption, waits for or forces a victim reconnection, and leverages residual fragments in memory to inject packets or extract sensitive data; no named threat actors are tied to active campaigns for this issue.

How to fix it

Apply vendor firmware and driver updates for affected Wi-Fi hardware and software stacks that enforce proper fragment cache clearing on reconnection; where updates are unavailable, disable WEP and prefer WPA3 with protected management frames.

How to confirm the fix worked

Confirm devices are running patched 802.11 implementations that clear fragment memory on reconnect, review vendor security advisories for the specific hardware models listed, and test by attempting fragment injection in a controlled environment post-update.

Typical attack path

1. Position on the same Wi-Fi network as the target
2. Send crafted fragmented frames encrypted with WEP/CCMP/GCMP
3. Trigger or wait for target device reconnection to the network
4. Abuse uncleared fragment cache to reassemble and inject packets or exfiltrate data

How to detect it

Review wireless network logs and packet captures for anomalous fragmented frame patterns around reconnection events; look for signs of injected traffic or unexpected data flows in affected device telemetry, though specific IOCs are limited without active exploitation indicators.

What your security team should do

• Prioritize firmware and driver updates for all listed affected Wi-Fi products including Intel, Arista, and Linux mac80211 stacks
• Disable legacy WEP usage and enforce WPA3 with management frame protection where possible
• Monitor for unusual fragment patterns or injection attempts in wireless traffic logs