{"id":"CVE-2020-9395","aliases":["EUVD-2020-30216","GHSA-m35f-qmp6-pvj2","openSUSE-SU-2024:10895-1"],"status":"published","title":"An issue was discovered on Realtek RTL8195AM, RTL8711AM, RTL8711AF, and RTL8710AF devices before...","description":"An issue was discovered on Realtek RTL8195AM, RTL8711AM, RTL8711AF, and RTL8710AF devices before 2.0.6. A stack-based buffer overflow exists in the client code that takes care of WPA2's 4-way-handshake via a malformed EAPOL-Key packet with a long keydata buffer.","severity":{"version":"3.1","score":8,"vector":"CVSS:3.1/AV:A/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:H","level":"high","assessor":"primary","from":"nvd"},"epss":{"day":"2026-11-09","score":0.00778,"percentile":0.56124,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":false},"cwes":["CWE-120","CWE-787"],"published":"2020-07-06T21:09:28Z","modified":"2026-06-17T03:27:52Z","products":[{"vendor":"realtek","product":"rtl8195am_firmware"},{"vendor":"realtek","product":"rtl8710af_firmware"},{"vendor":"realtek","product":"rtl8711af_firmware"},{"vendor":"realtek","product":"rtl8711am_firmware"}],"references":[{"url":"https://github.com/ambiot/amb1_arduino/commit/dcea55cf9775a0166805b3db845b237ecd5e74ea#diff-d06e7a87f34cc464a56799a419033014","tags":["x_refsource_MISC","x_transferred","Patch","Third Party Advisory"]},{"url":"https://github.com/ambiot/amb1_sdk/commit/bc5173d5d4faf6829074b0f1e1b242c12b7777a3#diff-700c216fb376666eaeda0c892e8bdc09","tags":["x_refsource_MISC","x_transferred","Patch","Third Party Advisory"]},{"url":"https://www.amebaiot.com/en/security_bulletin/","tags":["x_refsource_MISC","x_transferred","Third Party Advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2020-9395"},{"url":"https://github.com/advisories/GHSA-m35f-qmp6-pvj2"},{"url":"","tags":["advisory"]},{"url":"https://www.suse.com/security/cve/CVE-2019-17666","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2020-9395","tags":["web"]}],"sources":{"cve":[{"id":"CVE-2020-9395","description":"An issue was discovered on Realtek RTL8195AM, RTL8711AM, RTL8711AF, and RTL8710AF devices before 2.0.6. A stack-based buffer overflow exists in the client code that takes care of WPA2's 4-way-handshake via a malformed EAPOL-Key packet with a long keydata buffer.","status":"published","published":"2020-07-06T21:09:28Z","modified":"2024-08-04T10:26:16.113Z","updated_at":"2026-11-02T14:35:49.879248Z"}],"euvd":[{"id":"EUVD-2020-30216","description":"An issue was discovered on Realtek RTL8195AM, RTL8711AM, RTL8711AF, and RTL8710AF devices before 2.0.6. A stack-based buffer overflow exists in the client code that takes care of WPA2's 4-way-handshake via a malformed EAPOL-Key packet with a long keydata buffer.","status":"published","published":"2020-07-06T21:09:28Z","modified":"2024-08-04T10:26:16Z","updated_at":"2026-11-03T03:07:54.025234Z"}],"ghsa":[{"id":"GHSA-m35f-qmp6-pvj2","title":"An issue was discovered on Realtek RTL8195AM, RTL8711AM, RTL8711AF, and RTL8710AF devices before...","description":"An issue was discovered on Realtek RTL8195AM, RTL8711AM, RTL8711AF, and RTL8710AF devices before 2.0.6. A stack-based buffer overflow exists in the client code that takes care of WPA2's 4-way-handshake via a malformed EAPOL-Key packet with a long keydata buffer.","status":"published","published":"2022-05-24T17:22:35Z","modified":"2023-01-29T05:03:07Z","cwes":["CWE-120"],"updated_at":"2026-11-02T14:45:15.109911Z"}],"nvd":[{"id":"CVE-2020-9395","description":"An issue was discovered on Realtek RTL8195AM, RTL8711AM, RTL8711AF, and RTL8710AF devices before 2.0.6. A stack-based buffer overflow exists in the client code that takes care of WPA2's 4-way-handshake via a malformed EAPOL-Key packet with a long keydata buffer.","status":"published","published":"2020-07-06T22:15:11.553Z","modified":"2026-06-17T03:27:52.537Z","cvss":[{"version":"3.1","score":8,"vector":"CVSS:3.1/AV:A/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:H","level":"high","assessor":"primary"},{"version":"2.0","score":4.9,"vector":"AV:A/AC:M/Au:S/C:P/I:P/A:P","level":"medium","assessor":"primary"}],"cwes":["CWE-787"],"updated_at":"2026-11-02T14:06:08.145904Z"}],"osv":[{"id":"openSUSE-SU-2024:10895-1","title":"kismet-2021_08_R1-1.2 on GA media","description":"These are all security issues fixed in the kismet-2021_08_R1-1.2 package on the GA media of openSUSE Tumbleweed.","status":"published","published":"2024-06-15T00:00:00Z","modified":"2026-02-04T03:51:47.298225Z","updated_at":"2026-11-02T16:58:34.894275Z"}]}}