Sign-up

ID

VAR-202106-0357


CVE

CVE-2020-27302


TITLE

Realtek RTL8710  Out-of-bounds Vulnerability in Microsoft

Trust: 0.8

sources: JVNDB: JVNDB-2021-007803

DESCRIPTION

A stack buffer overflow in Realtek RTL8710 (and other Ameba-based devices) can lead to remote code execution via the "memcpy" function, when an attacker in Wi-Fi range sends a crafted "Encrypted GTK" value as part of the WPA2 4-way-handshake. Realtek RTL8710 ( And other Ameba-based device ) Is vulnerable to an out-of-bounds write.Information is obtained, information is tampered with, and service is disrupted (DoS) It may be put into a state. Pillow is a Python-based image processing library. There is currently no information about this vulnerability, please feel free to follow CNNVD or manufacturer announcements. Realtek RTL8710 is an IoT microcontroller from Taiwan's Realtek Semiconductor Company

Trust: 3.24

sources: NVD: CVE-2020-27302 // JVNDB: JVNDB-2021-007803 // CNVD: CNVD-2021-56811 // CNNVD: CNNVD-202104-975 // CNNVD: CNNVD-202106-355

IOT TAXONOMY

category:['IoT']sub_category: -

Trust: 0.6

category:['other device', 'embedded device']sub_category:chip

Trust: 0.1

category:['other device', 'embedded device']sub_category:general

Trust: 0.1

sources: OTHER: None // CNVD: CNVD-2021-56811

AFFECTED PRODUCTS

vendor:realtekmodel:rtl8195ascope:eqversion: -

Trust: 1.0

vendor:realtekmodel:rtl8710cscope:eqversion: -

Trust: 1.0

vendor:realtek semiconductor corpmodel:rtl8195ascope: - version: -

Trust: 0.8

vendor:realtek semiconductor corpmodel:rtl8710cscope: - version: -

Trust: 0.8

vendor:realtekmodel:rtl8710scope: - version: -

Trust: 0.6

sources: CNVD: CNVD-2021-56811 // JVNDB: JVNDB-2021-007803 // NVD: CVE-2020-27302

CVSS

SEVERITY

CVSSV2

CVSSV3

nvd@nist.gov: CVE-2020-27302
value: HIGH

Trust: 1.0

NVD: CVE-2020-27302
value: HIGH

Trust: 0.8

CNVD: CNVD-2021-56811
value: HIGH

Trust: 0.6

CNNVD: CNNVD-202104-975
value: MEDIUM

Trust: 0.6

CNNVD: CNNVD-202106-355
value: HIGH

Trust: 0.6

nvd@nist.gov: CVE-2020-27302
severity: HIGH
baseScore: 7.7
vectorString: AV:A/AC:L/AU:S/C:C/I:C/A:C
accessVector: ADJACENT_NETWORK
accessComplexity: LOW
authentication: SINGLE
confidentialityImpact: COMPLETE
integrityImpact: COMPLETE
availabilityImpact: COMPLETE
exploitabilityScore: 5.1
impactScore: 10.0
acInsufInfo: NONE
obtainAllPrivilege: NONE
obtainUserPrivilege: NONE
obtainOtherPrivilege: NONE
userInteractionRequired: NONE
version: 2.0

Trust: 1.8

CNVD: CNVD-2021-56811
severity: HIGH
baseScore: 7.7
vectorString: AV:A/AC:L/AU:S/C:C/I:C/A:C
accessVector: ADJACENT_NETWORK
accessComplexity: LOW
authentication: SINGLE
confidentialityImpact: COMPLETE
integrityImpact: COMPLETE
availabilityImpact: COMPLETE
exploitabilityScore: 5.1
impactScore: 10.0
acInsufInfo: NONE
obtainAllPrivilege: NONE
obtainUserPrivilege: NONE
obtainOtherPrivilege: NONE
userInteractionRequired: NONE
version: 2.0

Trust: 0.6

nvd@nist.gov: CVE-2020-27302
baseSeverity: HIGH
baseScore: 8.0
vectorString: CVSS:3.1/AV:A/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
attackVector: ADJACENT
attackComplexity: LOW
privilegesRequired: LOW
userInteraction: NONE
scope: UNCHANGED
confidentialityImpact: HIGH
integrityImpact: HIGH
availabilityImpact: HIGH
exploitabilityScore: 2.1
impactScore: 5.9
version: 3.1

Trust: 1.0

NVD: CVE-2020-27302
baseSeverity: HIGH
baseScore: 8.0
vectorString: CVSS:3.0/AV:A/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
attackVector: ADJACENT NETWORK
attackComplexity: LOW
privilegesRequired: LOW
userInteraction: NONE
scope: UNCHANGED
confidentialityImpact: HIGH
integrityImpact: HIGH
availabilityImpact: HIGH
exploitabilityScore: NONE
impactScore: NONE
version: 3.0

Trust: 0.8

sources: CNVD: CNVD-2021-56811 // JVNDB: JVNDB-2021-007803 // CNNVD: CNNVD-202104-975 // CNNVD: CNNVD-202106-355 // NVD: CVE-2020-27302

PROBLEMTYPE DATA

problemtype:CWE-787

Trust: 1.0

problemtype:Out-of-bounds writing (CWE-787) [NVD Evaluation ]

Trust: 0.8

sources: JVNDB: JVNDB-2021-007803 // NVD: CVE-2020-27302

THREAT TYPE

remote or local

Trust: 0.6

sources: CNNVD: CNNVD-202106-355

TYPE

other

Trust: 0.6

sources: CNNVD: CNNVD-202104-975

PATCH

title:top pageurl:https://www.realtek.com/ja/

Trust: 0.8

sources: JVNDB: JVNDB-2021-007803

EXTERNAL IDS

db:NVDid:CVE-2020-27302

Trust: 3.9

db:JVNDBid:JVNDB-2021-007803

Trust: 0.8

db:CNVDid:CNVD-2021-56811

Trust: 0.6

db:CS-HELPid:SB2021041363

Trust: 0.6

db:CNNVDid:CNNVD-202104-975

Trust: 0.6

db:CS-HELPid:SB2021060501

Trust: 0.6

db:CNNVDid:CNNVD-202106-355

Trust: 0.6

db:OTHERid:NONE

Trust: 0.1

sources: OTHER: None // CNVD: CNVD-2021-56811 // JVNDB: JVNDB-2021-007803 // CNNVD: CNNVD-202104-975 // CNNVD: CNNVD-202106-355 // NVD: CVE-2020-27302

REFERENCES

url:https://www.vdoo.com/blog/realtek-wifi-vulnerabilities-zero-day

Trust: 1.6

url:https://nvd.nist.gov/vuln/detail/cve-2020-27302

Trust: 1.4

url:https://jfrog.com/blog/revisiting-realtek-a-new-set-of-critical-wi-fi-vulnerabilities-discovered-by-automated-zero-day-analysis/?vr=1

Trust: 0.8

url:https://www.seeedstudio.com/rtl8710-wifi-module-p-2793.html

Trust: 0.6

url:https://www.cybersecurity-help.cz/vdb/sb2021041363

Trust: 0.6

url:https://www.cybersecurity-help.cz/vdb/sb2021060501

Trust: 0.6

url:https://ieeexplore.ieee.org/abstract/document/10769424

Trust: 0.1

sources: OTHER: None // CNVD: CNVD-2021-56811 // JVNDB: JVNDB-2021-007803 // CNNVD: CNNVD-202104-975 // CNNVD: CNNVD-202106-355 // NVD: CVE-2020-27302

SOURCES

db:OTHERid: -
db:CNVDid:CNVD-2021-56811
db:JVNDBid:JVNDB-2021-007803
db:CNNVDid:CNNVD-202104-975
db:CNNVDid:CNNVD-202106-355
db:NVDid:CVE-2020-27302

LAST UPDATE DATE

2025-01-30T19:51:42.588000+00:00


SOURCES UPDATE DATE

db:CNVDid:CNVD-2021-56811date:2021-07-30T00:00:00
db:JVNDBid:JVNDB-2021-007803date:2022-02-22T08:53:00
db:CNNVDid:CNNVD-202104-975date:2021-04-14T00:00:00
db:CNNVDid:CNNVD-202106-355date:2021-06-15T00:00:00
db:NVDid:CVE-2020-27302date:2021-06-14T18:06:32.763

SOURCES RELEASE DATE

db:CNVDid:CNVD-2021-56811date:2021-07-30T00:00:00
db:JVNDBid:JVNDB-2021-007803date:2022-02-22T00:00:00
db:CNNVDid:CNNVD-202104-975date:2021-04-13T00:00:00
db:CNNVDid:CNNVD-202106-355date:2021-06-04T00:00:00
db:NVDid:CVE-2020-27302date:2021-06-04T13:15:08.660