Security Experts:

Connect with us

Hi, what are you looking for?

SecurityWeekSecurityWeek

IoT Security

Impacted Vendors Release Advisories for FragAttacks Vulnerabilities

Vendors release advisories for FragAttacks Wi-Fi vulnerabilities

Vendors release advisories for FragAttacks Wi-Fi vulnerabilities

Impacted vendors have released security advisories in response to the recently disclosed Wi-Fi vulnerabilities collectively tracked as FragAttacks.

A dozen CVE identifiers have been assigned to the FragAttacks (fragmentation and aggregation attacks) flaws discovered last year by researcher Mathy Vanhoef, including three for design flaws and nine for implementation flaws.

Vanhoef tested 75 Wi-Fi devices and found that they were all affected by at least one vulnerability, but most of them were impacted by multiple issues. This suggests that a vast majority — if not all — devices with Wi-Fi capabilities are exposed to attacks. The design flaws are more difficult to exploit, while the implementation weaknesses are easier to use in attacks.

The researcher demonstrated that the vulnerabilities can allow an attacker who is within Wi-Fi range of the targeted device to conduct various activities, including redirect users to arbitrary websites, take control of devices on the network, bypass router firewalls, steal user information, and spy on victims.

Some of the affected vendors have been notified and given 9 months to release patches. Shortly after Vanhoef made his findings public, more than a dozen vendors released advisories, and some organizations, such as the Wi-Fi Alliance, have released statements on FragAttacks.

Some vendors say their products are affected only by the design flaws, but others appear to be impacted by multiple CVEs. Some companies noted that their products are affected due to the use of third-party components.

A majority of vendors have assigned the flaws a moderate/medium severity rating. Some have already released updates that should address the vulnerabilities, while others say they are working on developing patches.

Here is a list of vendors and other organizations that have released advisories and statements to date:

Written By

Eduard Kovacs (@EduardKovacs) is a contributing editor at SecurityWeek. He worked as a high school IT teacher for two years before starting a career in journalism as Softpedia’s security news reporter. Eduard holds a bachelor’s degree in industrial informatics and a master’s degree in computer techniques applied in electrical engineering.

Click to comment

Expert Insights

Related Content

Application Security

Cycode, a startup that provides solutions for protecting software source code, emerged from stealth mode on Tuesday with $4.6 million in seed funding.

Management & Strategy

Industry professionals comment on the recent disruption of the Hive ransomware operation and its hacking by law enforcement.

Cloud Security

VMware vRealize Log Insight vulnerability allows an unauthenticated attacker to take full control of a target system.

IoT Security

Lexmark warns of a remote code execution (RCE) vulnerability impacting over 120 printer models, for which PoC code has been published.

Management & Strategy

Tens of cybersecurity companies have announced cutting staff over the past year, in some cases significant portions of their global workforce.

Mobile & Wireless

Apple rolled out iOS 16.3 and macOS Ventura 13.2 to cover serious security vulnerabilities.

Email Security

Microsoft is urging customers to install the latest Exchange Server updates and harden their environments to prevent malicious attacks.

Management & Strategy

SecurityWeek examines how a layoff-induced influx of experienced professionals into the job seeker market is affecting or might affect, the skills gap and recruitment...