CVE-2020-26145: Samsung Galaxy I9305 Firmware RCE Flaw

CVE-2020-26145 Overview

CVE-2020-26145 is a Wi-Fi protocol implementation flaw disclosed as part of the FragAttacks research by Mathy Vanhoef. The vulnerability affects the Samsung Galaxy S3 i9305 running Android 4.4.4 and multiple Siemens SCALANCE industrial wireless devices. Affected WEP, WPA, WPA2, and WPA3 implementations accept second or subsequent broadcast fragments even when delivered in plaintext, then process them as full unfragmented frames. An adjacent-network adversary can abuse this design flaw to inject arbitrary network packets regardless of the negotiated encryption configuration [CWE-20].

Critical Impact
Attackers within radio range can inject arbitrary plaintext frames into protected Wi-Fi networks, bypassing the integrity guarantees of WPA2 and WPA3.

Affected Products

Samsung Galaxy S3 i9305 (firmware 4.4.4)
Siemens SCALANCE W1750D access points (multiple 6GK5766 and 6GK5763 variants)
Wi-Fi client and access point firmware implementing fragmentation per the affected 802.11 specification

Discovery Timeline

2021-05-11 - CVE-2020-26145 published to NVD as part of the FragAttacks coordinated disclosure by Mathy Vanhoef
2026-04-14 - Last updated in NVD database

Technical Details for CVE-2020-26145

Vulnerability Analysis

The vulnerability resides in how affected Wi-Fi stacks handle 802.11 frame fragmentation for broadcast traffic. Under a compliant implementation, fragmented frames belonging to an encrypted association must themselves be encrypted and reassembled before delivery. Affected implementations instead accept a second or later broadcast fragment that arrives in plaintext and treat it as a complete, standalone frame.

This behavior breaks the integrity boundary the link-layer encryption is meant to enforce. An attacker on the same radio medium does not need the network key. The attacker only needs to craft a frame that the receiver interprets as a non-first fragment of a broadcast transmission.

The injected frame is then handed up the stack as if it were a legitimate broadcast packet from the access point. This enables traffic injection scenarios such as forged ARP responses, ICMPv6 router advertisements, or DHCP messages targeting wireless clients.

Root Cause

The root cause is improper input validation in fragment reassembly logic. Affected stacks fail to enforce that all fragments of a protected frame share the same encryption state. Plaintext continuation fragments are accepted instead of being discarded.

Attack Vector

Exploitation requires an adjacent network position, meaning the attacker must be within Wi-Fi range of either the access point or the victim client. No authentication or user interaction is required. The attacker transmits a crafted 802.11 data frame with the More Fragments flag clear and a fragment number greater than zero, addressed as broadcast traffic.

The vulnerability mechanism is described in detail in the FragAttacks research summary and on the FragAttacks official website. No public exploit code beyond the researcher's proof-of-concept test suite is required to reproduce the issue.

Detection Methods for CVE-2020-26145

Indicators of Compromise

Unexpected plaintext 802.11 data frames with non-zero fragment numbers observed on a protected wireless network
Broadcast or multicast frames received by clients that do not correlate to access point transmissions in controller logs
Anomalous ARP, ICMPv6, or DHCP traffic appearing on wireless segments without matching wired-side originators

Detection Strategies

Deploy a wireless intrusion detection system (WIDS) that inspects 802.11 fragmentation flags and flags plaintext fragments on encrypted SSIDs
Capture full 802.11 headers with monitor-mode sensors and alert on frames where fragment number is greater than zero but the Protected Frame bit is unset
Validate access point vendor firmware against the Siemens Security Advisory SSA-913875 to identify exposed device models

Monitoring Recommendations

Forward WIDS and access point logs to a centralized analytics platform for correlation with endpoint telemetry
Monitor wireless clients for unsolicited gateway changes, rogue DHCP offers, and ARP cache anomalies indicative of injected frames
Track firmware versions of all wireless infrastructure devices against vendor advisories on a recurring basis

How to Mitigate CVE-2020-26145

Immediate Actions Required

Inventory all Samsung Galaxy S3 i9305 devices and Siemens SCALANCE wireless products listed in vendor advisories and prioritize firmware updates
Where vendor patches are unavailable, retire or segment legacy Wi-Fi clients that cannot be updated
Enforce application-layer encryption such as TLS or IPsec on wireless segments to neutralize injected plaintext frames

Patch Information

Siemens published advisory SSA-913875 addressing affected SCALANCE W1750D firmware variants. Samsung Galaxy S3 i9305 running Android 4.4.4 is end-of-life and is not expected to receive a vendor patch. Operators must rely on compensating controls or device replacement for the Samsung hardware.

Workarounds

Disable Wi-Fi fragmentation on access points where the configuration option is available
Require IPsec, TLS, or VPN tunneling for any traffic traversing wireless networks to ensure end-to-end integrity
Segment legacy Wi-Fi clients on isolated VLANs with strict egress filtering to limit the impact of injected frames

bash

# Example: enforce VPN-only egress for a legacy wireless VLAN on a Linux gateway
iptables -A FORWARD -i wlan-legacy -o eth0 -j DROP
iptables -A FORWARD -i wlan-legacy -o tun0 -j ACCEPT