CVE-2020-25854

The function DecWPA2KeyData() in the Realtek RTL8195A Wi-Fi Module prior to versions released in April 2020 (up to and excluding 2.08) does not validate the size parameter for an internal function, rt_arc4_crypt_veneer() or _AES_UnWRAP_veneer(), resulting in a stack buffer overflow which can be exploited for remote code execution or denial of service. An attacker can impersonate an Access Point and attack a vulnerable Wi-Fi client, by injecting a crafted packet into the WPA2 handshake. The attacker needs to know the network's PSK in order to exploit this.

• CWE-121
• CWE-787

• https://www.vdoo.com/blog/realtek-rtl8195a-vulnerabilities-discovered/Exploit, Third Party Advisory
• https://www.vdoo.com/blog/realtek-rtl8195a-vulnerabilities-discovered/Exploit, Third Party Advisory

Published

Feb 3, 2021

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2020-25847This command injection vulnerability allows attackers to exe…8.8
• CVE-2020-25848HGiga MailSherlock contains weak authentication flaw that at…9.8
• CVE-2020-25849MailGates and MailAudit products contain Command Injection f…8.8
• CVE-2020-2585Vulnerability in the Java SE product of Oracle Java SE (comp…5.9
• CVE-2020-25850The function, view the source code, of HGiga MailSherlock do…7.5
• CVE-2020-25853The function CheckMic() in the Realtek RTL8195A Wi-Fi Module…7.5
• CVE-2020-25855The function AES_UnWRAP() in the Realtek RTL8195A Wi-Fi Modu…8.1
• CVE-2020-25856The function DecWPA2KeyData() in the Realtek RTL8195A Wi-Fi …8.1
• CVE-2020-25857The function ClientEAPOLKeyRecvd() in the Realtek RTL8195A W…7.5
• CVE-2020-25858The QCMAP_Web_CLIENT binary in the Qualcomm QCMAP software s…7.5
• CVE-2020-25859The QCMAP_CLI utility in the Qualcomm QCMAP software suite p…6.7
• CVE-2020-2586Vulnerability in the Oracle Human Resources product of Oracl…9.9