Loading vulnerability…
CVE-2020-24588 is a Wi-Fi protocol/design flaw in IEEE 802.11 frame aggregation handling. The 802.11 standard used by WEP, WPA, WPA2, and WPA3 does not require authentication of the A-MSDU flag in the plaintext QoS header field. On devices that accept non-SPP A-MSDU frames, an attacker can manipulate this unauthenticated header state so that a protected frame is interpreted as an aggregated frame. This enables injection of arbitrary network packets over the wireless link. The issue is commonly described as accepting non-SPP A-MSDU frames and is part of the FragAttacks class of Wi-Fi vulnerabilities.
Mallory correlates every CVE against your assets, your vendors, and active adversary campaigns. Know which vulnerabilities matter for you, not just which ones are loud.
What it means. What to do now. Patch path, mitigations, and the assume-compromise checklist.
What an attacker gets, and what they’ve been doing with it.
If you can’t patch tonight, do this now.
Patch, then assume compromise.
1 valid exploit after Mallory filtered fakes, detection scripts, and README-only repos.
This repository is a standalone Python wireless exploitation toolkit named Fracture. It is not tied to a common exploit framework. The codebase contains 12 files, with the main logic split across fracture/__main__.py (CLI/orchestration), scanner.py (802.11 AP/client discovery and fingerprinting), injector.py (crafted A-MSDU/FragAttacks packet generation and helper payload builders), paths.py (attack-chain execution), portal.py (captive portal detection, cloning, and credential harvesting), and tui.py (console UI). setup.py exposes a console entry point named 'fracture'. Primary capability: exploitation of FragAttacks-style weaknesses, especially CVE-2020-24588, by crafting 802.11 QoS Data frames with the A-MSDU flag set so that inner plaintext IP packets are processed on encrypted WiFi networks without knowing the PSK. The implementation is explicitly UDP-first because UDP does not require a completed handshake. Built packet types include NAT-PMP requests, SNMP requests/SETs, DNS-related traffic, SSDP discovery, and a fallback raw HTTP/TCP request generator. Operationally, the tool scans channels 1-13, identifies APs, associated clients, encryption type, WPS, and a heuristic for captive portals. It then offers three attack paths: (1) router-focused NAT-PMP/SNMP injection to open WAN port forwards or reconfigure devices; (2) captive portal redirection and cloned portal credential harvesting using a local Flask server and saved credentials under /tmp/fracture_creds.txt; and (3) SNMP-based device pivoting with callback listeners on UDP 162/514/123/6343 plus NAT-PMP checks for externally reachable forwarded SSH on TCP 62222 to internal TCP 22. The repository contains real exploit-oriented code rather than just detection logic. While some README claims are broader than the visible code excerpts, the implementation clearly supports wireless packet injection, router/service targeting, portal cloning, and credential capture. Because payloads and targets are mostly hardcoded/basic rather than fully modular, the maturity is best classified as OPERATIONAL rather than WEAPONIZED.
Products and vendors Mallory has correlated with this vulnerability. Open in Mallory to drill down to specific CPE configurations and version ranges.
Vendor-confirmed product mapping. Mallory continuously reconciles this list against your asset inventory.
6 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.
Query your assets running an affected version, and investigate the blast radius.
Every observed campaign linking this CVE to a named adversary.
Malware families riding this exploit, with evidence and IOCs.
YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.
Cross-references every affected SKU, including bundled OEM variants.
Community discussion across Reddit, Mastodon, and other social sources.