CVE-2020-24587

EUVD-2020-17304 · Published May 11, 2021

The 802.11 standard that underpins Wi-Fi Protected Access (WPA, WPA2, and WPA3) and Wired Equivalent Privacy (WEP) doesn't require that all fragments of a frame are encrypted under the same key. An adversary can abuse this to decrypt selected fragments when another device sends fragmented frames and the WEP, CCMP, or GCMP encryption key is periodically renewed.

Technologies

Cisco Catalyst 9130 Ap FirmwareCisco Catalyst 9120Axp FirmwareCisco Aironet 1572 FirmwareCisco Aironet 1815 FirmwareCisco Aironet 1832Cisco Meraki Mr56 FirmwareCisco Catalyst 9117Axi FirmwareCisco Meraki Mx67CwCisco Catalyst 9120Axi FirmwareCisco Catalyst 9120AxeCisco Meraki Mx67WCisco Catalyst 9115Axe FirmwareIntel Proset Ac 8265 FirmwareCisco Aironet 3800 FirmwareCisco Meraki Mr36 FirmwareCisco Meraki Mx64WCisco Catalyst 9130 FirmwareCisco Meraki Mr45Cisco Ir829-2Lte-Ea-Bk9 FirmwareCisco Meraki Mr42Cisco Meraki Mx68CwCisco Catalyst 9130Axi FirmwareCisco Catalyst 9120 Ap FirmwareCisco Meraki Z3Cisco Meraki Mr72Cisco Webex Dx70 FirmwareCisco Meraki Mx68Cw FirmwareCisco Webex Room 70 Single G2Cisco Catalyst 9105Axi FirmwareCisco 1100 FirmwareCisco Meraki Mr70 FirmwareCisco Webex Room 70 Dual G2Arista O-105 FirmwareCisco Meraki Mr34 FirmwareCisco Catalyst Iw6300 Dcw FirmwareArista W-68 FirmwareIntel Proset Ac 9260Cisco Ir829Gw-Lte-Vz-Ak9 FirmwareCisco Catalyst 9117AxiArista C-65 FirmwareCisco Catalyst Iw6300 Ac FirmwareCisco Aironet 1702Cisco Ir829Gw-Lte-Ga-Sk9 FirmwareCisco Webex Board 70S FirmwareCisco Aironet 1852Intel Proset Ac 9462 FirmwareArista C-250Cisco Aironet 3800EIntel Proset Wi-Fi 6 Ax201 FirmwareCisco Aironet 1542I FirmwareCisco Ir829Gw-Lte-Ga-Zk9Cisco Ir829-2Lte-Ea-Ak9Cisco Catalyst 9115AxeCisco Webex Room Kit MiniCisco Meraki Mr44 FirmwareCisco Ip Phone 8861 FirmwareIntel Proset Wireless 7265 \(Rev D\) FirmwareCisco Aironet Ap803Intel Proset Wi-Fi 6E Ax210Cisco Meraki Mr42ECisco Aironet 1842 FirmwareCisco Catalyst 9105Axw FirmwareCisco Webex Room 55 DualCisco Catalyst 9115 Ap FirmwareCisco Catalyst 9130Cisco Meraki Mr32Cisco Aironet 2800Arista C-120Cisco Aironet 1800 FirmwareArista C-235 FirmwareIntel Ac 8265 FirmwareCisco Aironet 1552Cisco Meraki Mr76Cisco Aironet 1815Cisco Catalyst Iw6300 DcwCisco Aironet 1542D FirmwareCisco Ir829Gw-Lte-Na-Ak9Intel Ac 8260Cisco Ir829-2Lte-Ea-Bk9Cisco 1101-4PArista C-230 FirmwareArista C-110Cisco Ir829-2Lte-Ea-Ek9 FirmwareArista O-105Cisco Aironet 3702 FirmwareCisco Ir829Gw-Lte-Vz-Ak9Cisco Esw6300 FirmwareCisco Meraki Z3C FirmwareCisco Meraki Mr70Cisco Aironet 4800Intel Proset Ac 8260Cisco Aironet 1800Cisco Ip Phone 8865Arista C-100Cisco Meraki Mx68WCisco Meraki Mr30HCisco Aironet 1800I FirmwareCisco Webex Room KitIntel Killer Ac 1550 FirmwareCisco Catalyst 9117 Ap FirmwareCisco Meraki Mr86 FirmwareArista C-75Cisco Webex Room 70 Single FirmwareCisco Aironet 1852 FirmwareCisco Aironet Iw3702Intel Proset Ac 8260 FirmwareCisco Meraki Mx65WCisco 1109-4PArista C-235Cisco Meraki Mr53Intel Wi-Fi 6 Ax201 FirmwareCisco Meraki Mx68W FirmwareCisco Webex Room 70Cisco Meraki Mr86Cisco Webex Board 70 FirmwareCisco Catalyst 9124AxiCisco Meraki Mx64W FirmwareCisco Meraki Mr20Cisco Meraki Z3 FirmwareCisco Aironet 1532Intel Killer Wi-Fi 6 Ax1650 FirmwareCisco Aironet 2800I FirmwareCisco Catalyst 9115 ApCisco Ip Phone 8865 FirmwareCisco Catalyst 9105AxiCisco Ip Phone 8832 FirmwareIntel Ac 9560 FirmwareCisco Aironet 1815I FirmwareIntel Ac 8265Cisco 1100-4P FirmwareCisco Catalyst Iw6300 FirmwareArista C-230Cisco Catalyst 9130AxeCisco Aironet 2800ICisco Esw6300Cisco Webex Room 55Cisco Webex Room 70 Dual FirmwareCisco Aironet 1810WIntel Proset Wi-Fi 6E Ax210 FirmwareCisco Meraki Mr33Arista C-200Cisco Catalyst 9120 FirmwareCisco Meraki Mr53ECisco Webex Dx70Cisco Meraki Mr32 FirmwareCisco Aironet 3800Cisco Aironet 3800PArista O-90Cisco Meraki Mr34Arista W-118 FirmwareCisco Meraki Mr66 FirmwareCisco Ip Phone 8832Cisco Meraki Mr76 FirmwareCisco Aironet 2702Cisco Meraki Mr46E FirmwareCisco Catalyst Iw6300 AcCisco Meraki Mr84 FirmwareIntel Killer Wi-Fi 6 Ax1650Ieee Ieee 802.11Intel Ac 9260Cisco Aironet 3800E FirmwareCisco Webex Board 55S FirmwareCisco Aironet 1702 FirmwareCisco Webex Room Kit Mini FirmwareCisco Meraki Mx67Cw FirmwareCisco Meraki Mr53E FirmwareCisco Ip Phone 8861Arista C-260 FirmwareIntel Proset Ac 3165 FirmwareCisco Catalyst 9115AxiCisco Meraki Mr55Cisco Meraki Mr12 FirmwareIntel Proset Ac 9461Cisco Ir829Gw-Lte-Ga-Zk9 FirmwareCisco Ir829Gw-Lte-Ga-Sk9Cisco Aironet 1542ICisco Catalyst 9105AxwArista C-100 FirmwareArista C-130 FirmwareCisco Catalyst 9130Axe FirmwareIntel Proset Ac 9560Intel Proset Wi-Fi 6 Ax200Cisco Webex Board 55Cisco Meraki Mr46Cisco Catalyst 9105Cisco Aironet Ap803 FirmwareCisco Catalyst 9124AxdCisco Aironet 1800ICisco Catalyst 9130AxiArista C-65Cisco Aironet 1552HCisco Catalyst 9124Cisco Catalyst 9117 ApIntel Wi-Fi 6 Ax200Cisco Aironet 1810 FirmwareCisco Webex Dx80Cisco Ir829-2Lte-Ea-Ak9 FirmwareCisco Meraki Mr26Cisco Meraki Mx67W FirmwareCisco Webex Room 55 Dual FirmwareCisco Aironet 1552 FirmwareCisco Ir829-2Lte-Ea-Ek9Cisco Aironet 2702 FirmwareIntel Proset Ac 3168 FirmwareCisco Ir829Gw-Lte-Ga-Ck9Intel Killer Wi-Fi 6E Ax1675Cisco 1109-4P FirmwareCisco Meraki Gr10 FirmwareCisco Webex Board 55 FirmwareCisco Meraki Mr12Intel Proset Ac 3168Cisco Webex Room Kit FirmwareArista C-75 FirmwareDebian Debian LinuxCisco Meraki Mr44Intel Ac 9560Intel Wi-Fi 6 Ax201Intel Proset Ac 9260 FirmwareCisco Catalyst Iw6300 DcCisco Webex Room 70 FirmwareCisco Ir829Gw-Lte-Ga-Ek9Cisco Aironet 1552H FirmwareCisco Meraki Gr60Cisco Catalyst 9124 FirmwareCisco Webex Board 55SCisco Catalyst 9120AxpCisco Aironet 1542DCisco 1100Cisco Meraki Mr53 FirmwareCisco Catalyst Iw6300 Dc FirmwareCisco Webex Board 70SCisco Webex Room 70 Single G2 FirmwareCisco Ir829Gw-Lte-Na-Ak9 FirmwareCisco Catalyst 9117Cisco Catalyst 9115Cisco Meraki Mr52Intel Proset Ac 9462Cisco Catalyst 9130 ApArista W-118Cisco Catalyst 9120Axe FirmwareCisco 1109-2PArista C-130Cisco Aironet 3800P FirmwareIntel Proset Wireless 7265 \(Rev D\)Cisco Meraki Mr30H FirmwareCisco Aironet 2800ECisco Webex Dx80 FirmwareCisco Meraki Mr46ECisco Catalyst 9124Axd FirmwareCisco Webex Board 85SIntel Killer Ac 1550Cisco Meraki Mr84Intel Wi-Fi 6 Ax200 FirmwareCisco Webex Room 70 Dual G2 FirmwareCisco Catalyst 9124Axi FirmwareCisco Catalyst 9105 FirmwareCisco Meraki Mr62Intel Proset Ac 9461 FirmwareCisco Aironet Iw3702 FirmwareIntel Proset Ac 9560 FirmwareCisco Catalyst Iw6300Cisco 1100-8P FirmwareCisco Aironet 2800 FirmwareCisco Aironet 1810Cisco Meraki Mr45 FirmwareCisco Meraki Mr42E FirmwareCisco Meraki Mr62 FirmwareIntel Killer Wi-Fi 6E Ax1675 FirmwareIntel Ac 8260 FirmwareCisco Aironet 1842Cisco Meraki Gr60 FirmwareCisco Aironet 3702Cisco 1100-8PCisco Meraki Mr20 FirmwareLinux Mac80211Cisco Ip Phone 6861Cisco Webex Room 70 DualCisco Aironet 1572Cisco Meraki Mr55 FirmwareArista C-110 FirmwareCisco Webex Board 70Arista C-260Intel Ac 9260 FirmwareCisco Aironet 1815ICisco Meraki Mr36Cisco Aironet 2800E FirmwareArista C-250 FirmwareCisco 1109-2P FirmwareCisco Webex Room 70 SingleArista W-68Cisco Meraki Mr56Intel Proset Ac 3165Arista C-200 FirmwareCisco Catalyst 9115Axi FirmwareCisco 1100-4PCisco Meraki Mr26 FirmwareCisco Aironet 4800 FirmwareCisco Meraki Mx65W FirmwareCisco Meraki Mr42 FirmwareArista C-120 FirmwareCisco Meraki Mr52 FirmwareIntel Proset Wi-Fi 6 Ax201Cisco Catalyst 9117 FirmwareCisco Ir829Gw-Lte-Ga-Ck9 FirmwareCisco Aironet 3800I FirmwareCisco Meraki Gr10Cisco Catalyst 9120AxiCisco Aironet 1810W FirmwareCisco Meraki Mr66Cisco Catalyst 9120Cisco Ip Phone 6861 FirmwareCisco Aironet 1532 FirmwareArista O-90 FirmwareCisco Catalyst 9115 FirmwareCisco Catalyst 9120 ApCisco Ip Phone 8821Cisco 1101-4P FirmwareIntel Proset Ac 8265Cisco Ir829Gw-Lte-Ga-Ek9 FirmwareCisco Meraki Mr72 FirmwareCisco Ip Phone 8821 FirmwareCisco Meraki Z3CCisco Aironet 3800ILinux Linux KernelCisco Meraki Mr74Cisco Meraki Mr46 FirmwareIntel Proset Wi-Fi 6 Ax200 FirmwareCisco Meraki Mr33 FirmwareCisco Aironet 1832 FirmwareCisco Webex Board 85S FirmwareCisco Meraki Mr74 FirmwareCisco Webex Room 55 Firmware

Weaknesses

CWE-327

CVSS scores

v3.12.6CVSS:3.1/AV:A/AC:H/PR:N/UI:R/S:U/C:L/I:N/A:N
v2.01.8AV:A/AC:H/Au:N/C:P/I:N/A:N

MITRE ATT&CK

Inferred

Where this vulnerability fits in an attack

ReconImpact

Stealth Defense Impairment

T1036.001Invalid Code Signature T1553.002Code Signing

References

Potentially impacted assets

See if this affects your attack surface

Latest trending attack

Criticaltoday

Google Brotli decoder - Remote Code Execution via compressed requests (Exploitation Check)

This control is the second step of the Patrowl response to CVE-2026-111497 (Node2Shell). It complements the first control of 22 October 2026, which focused on the Node.js runtime, and does not replace it. Why a second control CVE-2026-111497 is an out-of-bounds write in the Google Brotli decoder, the library that decompresses Brotli ("br") data. It was first published as a Node.js vulnerability, because Node.js bundles this decoder. Later publications showed that the flaw is in the library itself. Every product that embeds an affected version of the decoder is concerned, whatever its language or vendor. A public proof of concept demonstrates code execution. Any server that decompresses request bodies sent with "Content-Encoding: br" exposes the decoder to unauthenticated attackers. Known cases include Express 5 and NestJS 11 on Node.js, Koa and Fastify setups, Bun, Envoy and Istio with request decompression enabled, and any application or reverse proxy that decodes Brotli request bodies with an affected library. The flaw also works in the other direction. A malicious server can compromise an unpatched client that decodes a Brotli response, for example Node.js fetch(), Python clients (requests, httpx, aiohttp, Scrapy) with the Brotli or brotlicffi package, or libcurl builds with Brotli support. What this control checks Patrowl sends small, valid Brotli-compressed requests to each asset and observes whether the server decodes them. The check does not depend on the technology: it detects the behaviour, whatever the stack behind it. These requests are what any legitimate client could send. They never reach the vulnerable code path and cannot affect the availability of the service. How to read the result Potentially impacted means the asset decodes Brotli request bodies: the attack surface is exposed. It does not confirm that the asset is vulnerable. The version of the Brotli decoder in use is not visible from the outside. This check covers applications that parse request bodies on their root path. A Not impacted result does not rule out exposure on other routes, nor on the client side. Checking the versions on the servers remains the only exhaustive verification. Two situations are possible. When the decoding is done by your own application or reverse proxy, identify the component and update it. If an update is not possible right away, reject requests with "Content-Encoding: br" at the reverse proxy or WAF. When the asset is hosted on a managed platform or behind a CDN (for example Platform.sh, Upsun or Fastly), the decoding may be done by the provider's edge router, in front of your application. You cannot patch it yourself, but this router handles all the traffic of your site. Ask your provider to confirm that its edge components are patched against CVE-2026-111497. Assets hosted on a managed platform or behind a CDN carry the tag "paas: platform.sh" or "cdn: fastly" in the asset view: for these assets, the Brotli decoding is done by the provider's edge router, in front of your application, and only the provider can patch it. Affected and fixed versions Google Brotli 1.0.3 to 1.2.0 are affected, fixed in 1.0.10, 1.1.1 and 1.2.1. Fixed releases of the main products embedding it: Node.js 22.23.4, 24.22.1 and 26.12.1 (end-of-life lines 20.x and older and 25.x receive no fix), Bun 1.4.4, Envoy 1.37.8, 1.38.6, 1.39.3 and 1.40.0, Istio 1.29.9, 1.30.6 and 1.31.2, Python Brotli 1.2.1 and brotlicffi 1.2.1.0. Products that link against the system library depend on the Brotli package of the Linux distribution. Recommendations Update every component that embeds the Brotli decoder (only real fix). Start with the assets flagged by this control. Restart the processes after the update. Rebuild containers, single-executable applications and appliances that bundle an affected runtime or library. Reduce the exposure until the update is deployed. Reject requests with "Content-Encoding: br" at the reverse proxy, load balancer or WAF, case-insensitively and including lists such as "gzip, br". On Envoy and Istio, disable request decompression for Brotli. Contact your edge provider about the status of the pathing (Fastly / Plateform.sh) Review outbound calls. List the features that fetch content from servers you do not control, and patch the services that host them first.