A stack buffer overflow in the Realtek RTL8195A Wi-Fi Module allows authenticated attackers in wireless range to perform remote code execution by impersonating a Wi-Fi access point
Ameba SDK (, 2.0.8), fixed in 2.0.8
Realtek Wi-Fi chips enable connectivity for embedded devices and are widely used in IoT development boards and production devices. This vulnerability affects the RTL8195A module. Attackers can exploit the module by impersonating an Access Point (AP) and injecting a packet into the WPA2 handshake to cause a stack buffer overflow. The exploit can overwrite stack contents with a malicious payload, achieving remote code execution. No public exploit is currently known for this vulnerability, but the JFrog blog provides sufficient technical details for an attacker to replicate the exploit. The firmware employs no mitigations against memory corruption attacks, such as stack canaries, the NX bit, or ASLR protections, making this easier to exploit. Since this is a Wi-Fi attack, the attacker must be close enough for the target device to connect to the attacker's AP. The function DecWPA2KeyData in the module's firmware does not validate a size parameter received on the network before passing it to one of two internal functions, rt_arc4_crypt_veneer or _AES_UnWRAP_veneer, depending on the access point's encryption algorithm. These functions will then decrypt a source buffer with attacker-controlled length into a fixed-size destination buffer on the stack. An attacker who knows the network's PSK will be able to provide a correctly encrypted payload for decryption onto the stack, resulting in malicious code execution.
No PoC is supplied for this issue
No vulnerability mitigations are supplied for this issue
(JFrog) WiFi Vulnerabilities Discovered by Automated Zero-Day Analysis