We detect you are using an unsupported browser. For the best experience, please visit the site using Chrome, Firefox, Safari, or Edge. X
Maximize Your Experience: Reap the Personalized Advantages by Completing Your Profile to Its Fullest! Update Here
Stay in the loop with the latest from Microchip! Update your profile while you are at it. Update Here
Complete your profile to access more resources.Update Here!
Item Qty
Your cart is empty.

FragAttack Wi-Fi® Vulnerabilities

Overview

Recent studies published by cyber security expert Mathy Vanhoef demonstrate a collection of security vulnerabilities known as FragAttacks (fragmentation and aggregation attacks) that affect Wi-Fi devices. In light of these vulnerabilities, we emphasize our commitment to providing secure and robust solutions that follow the latest industry practices and recommendations.

Potential Impact

An attacker within range of an affected Wi-Fi device can exploit the vulnerabilities described in the study to inject arbitrary packets. This can potentially allow an attacker to steal user information or conduct unauthorized activities.

Learn more about different FragAttack vulnerabilities:

CVE-2020-24586 Not clearing fragments from memory when reconnecting to a network  
CVE-2020-24587 Reassembling fragments encrypted under different keys  
CVE-2020-24588 Accepting non-SPP A-MSDU frames  
CVE-2020-26139 Forwarding EAPOL frames even though the sender is not yet authenticated  
CVE-2020-26140 Accepting plaintext data frames in a protected network  
CVE-2020-26141 Not verifying the TKIP MIC of fragmented frames  
CVE-2020-26142 Processing fragmented frames as full frames  
CVE-2020-26143 Accepting fragmented plaintext data frames in a protected network  
CVE-2020-26144 Accepting plaintext A-MSDU frames that start with an RFC1042 header with EtherType EAPOL (in an encrypted network)  
CVE-2020-26145 Accepting plaintext broadcast fragments as full frames (in an encrypted network)  
CVE-2020-26146 Reassembling encrypted fragments with non-consecutive packet numbers  
CVE-2020-26147 Reassembling mixed encrypted/plaintext fragments  

Information Regarding Our Wi-Fi Products

We’ve completed a full analysis of the attacks on our PIC32MZW1and WINC15x0 Wi-Fi Integrated Circuits (ICs). We found that the devices are vulnerable only to a subset of the attacks as identified in the table below. 

CVE ID CVSS Score PIC32MZW1 WILC1000/WILC3000 WINC15x0 WINC3400
CVE-2020-24586 3.5 (LOW) Vulnerable Vulnerable Not Vulnerable Not Vulnerable
CVE-2020-24588 3.5 (LOW) Vulnerable Vulnerable Vulnerable Vulnerable
CVE-2020-26139 5.3 (MEDIUM) Not Vulnerable Vulnerable Not Vulnerable Not Vulnerable
CVE-2020-26140 6.5 (MEDIUM) Vulnerable Vulnerable Vulnerable Vulnerable
CVE-2020-26143 6.5 (MEDIUM) Vulnerable Vulnerable Vulnerable Vulnerable
CVE-2020-26144 6.5 (MEDIUM) Vulnerable Vulnerable Vulnerable Vulnerable
CVE-2020-26146 5.3 (MEDIUM) Vulnerable Vulnerable Vulnerable Vulnerable
CVE-2020-26147 5.4 (MEDIUM) Partially Vulnerable Partially Vulnerable Partially Vulnerable Partially Vulnerable

Successful exploitation of these vulnerabilities may enable an attacker to use FragAttacks for the purpose of leaking information or data exfiltration. To enact this, the attacker must successfully orchestrate the injection of 802.11 packets, man-in-the-middle attacks and redirection of the device to a malicious server. Achieving this is difficult in practice and the attacks do not allow the bypassing of network layer protections provided by TLS.

PIC32MZW1/WFI32E01 Modules

MPLAB® Harmony wireless_wifi release versions 3.6.0 and higher provide firmware that is resistant to the FragAttack vulnerabilities disclosed in the table above. If you are using earlier releases than version 3.6.0, we recommend upgrading your applications to the latest wireless_wifi release.

We also recommend designing products with the most secure protocols available, such as:

  • TLS/HTTPS for all network connections where possible
  • WPA3 and 802.11w (PMF) for Wi-Fi connections where available

WILC Linux® (WILC1000 and WILC3000)

Firmware and Linux driver versions 15.6 and higher are resistant to the FragAttack vulnerabilities disclosed in the table above. For more information on the download locations of the firmware and driver packages, please refer to the version 15.6 or higher release note. We do not recommend customers use releases below 15.6 and to upgrade both your firmware and Linux driver.

We also recommend designing products with the most secure protocols available, such as: 

  • TLS/HTTPS for all network connections where possible
  • WPA3 and 802.11w (PMF) for Wi-Fi connections where available (NB: WPA3 and PMF are not supported on WILC3000)

WINC15x0/MR210 Modules

Firmware versions 19.7.6 and higher are resistant to the FragAttack vulnerabilities disclosed in the table above.

The FragAttack fixes are available as a firmware-only upgrade (compatible with driver versions 19.4.4 and higher). You can download the firmware directly from our website.

Firmware version 19.7.6 is shipped with MPLAB Harmony wireless_wifi release 3.6.0. Products built using this version of the wireless_wifi or higher are already resistant to FragAttacks.

Please refer to the ATWINC15x0 19.7.6 software release notes on the WINC15x0 product page for instructions on upgrading your WINC15x0 platform.

We also recommend designing products with the most secure protocols available, such as: 

  • TLS/HTTPS for all network connections where possible
  • WPA2 for Wi-Fi connections where available

WINC3400/MR210 Modules

Firmware versions 1.4.3 and higher are resistant to the FragAttack vulnerabilities disclosed in the table above.

The FragAttack fixes are available as a firmware-only upgrade (compatible with driver versions 1.1 and higher). You can download the firmware directly from our website.

Firmware version 1.4.3 is shipped with MPLAB Harmony wireless_wifi release 3.6.1. Products built using this version of the wireless_wifi or higher are already resistant to FragAttacks.

Please refer to the ATWINC3400 1.4.3 software release notes on the WINC3400 product page for instructions on upgrading your WINC3400 platform.

We also recommend designing products with the most secure protocols available, such as: 

  • TLS/HTTPS for all network connections where possible
  • WPA2 for Wi-Fi connections where available

Documentation