CVE-2020-11287

Q: What is the severity of CVE-2020-11287?

CVE-2020-11287 has a CVSS score of 7.5 (HIGH). This vulnerability in Qualcomm Snapdragon chipsets allows attackers to link RTT (Round Trip Time) frames with non-randomized MAC addresses by comparing sequence numbers, potentially exposing location tracking and device identification information. It affects numerous Snapdragon product lines including Auto, Compute, Mobile, and IoT devices. The vulnerability enables information disclosure about device proximity and movement patterns.

7.5 HIGH

📋 TL;DR

This vulnerability in Qualcomm Snapdragon chipsets allows attackers to link RTT (Round Trip Time) frames with non-randomized MAC addresses by comparing sequence numbers, potentially exposing location tracking and device identification information. It affects numerous Snapdragon product lines including Auto, Compute, Mobile, and IoT devices. The vulnerability enables information disclosure about device proximity and movement patterns.

💻 Affected Systems

Products:

Snapdragon Auto
Snapdragon Compute
Snapdragon Connectivity
Snapdragon Consumer Electronics Connectivity
Snapdragon Consumer IOT
Snapdragon Industrial IOT
Snapdragon Mobile
Snapdragon Voice & Music
Snapdragon Wired Infrastructure and Networking

Versions: Specific affected versions not publicly detailed in advisory

Operating Systems: Android and other OS using affected Snapdragon chipsets

Default Config Vulnerable: ⚠️ Yes

Notes: Affects devices using vulnerable Snapdragon chipsets with Wi-Fi functionality enabled.

📦 What is this software?

⚠️ Risk & Real-World Impact

🔴

Worst Case

Attackers can persistently track device locations, movements, and proximity to other devices, enabling physical surveillance, stalking, or targeted attacks based on location patterns.

🟠

Likely Case

Local attackers in Wi-Fi range can gather information about device presence, movement patterns, and potentially identify specific devices for further targeting.

🟢

If Mitigated

With proper network segmentation and monitoring, impact is limited to local network visibility rather than broader information disclosure.

🌐 Internet-Facing: LOW - This requires local network access and proximity to the target device.

🏢 Internal Only: MEDIUM - Internal attackers with network access could exploit this for reconnaissance and tracking within the organization.

🎯 Exploit Status

Public PoC: ✅ No

Weaponized: UNKNOWN

Unauthenticated Exploit: ⚠️ Yes

Complexity: MEDIUM

Exploitation requires proximity to target device and knowledge of Wi-Fi network analysis techniques.

🛠️ Fix & Mitigation

✅ Official Fix

Patch Version: Refer to Qualcomm February 2021 security bulletin for specific patched versions

Vendor Advisory: https://www.qualcomm.com/company/product-security/bulletins/february-2021-bulletin

Restart Required: Yes

Instructions:

1. Check device manufacturer for firmware updates. 2. Apply Qualcomm-provided patches through OEM updates. 3. Reboot device after update installation. 4. Verify patch application through version checking.

🔧 Temporary Workarounds

Disable Wi-Fi when not needed

all

Turn off Wi-Fi functionality to prevent RTT frame transmission

# Android: adb shell svc wifi disable
# Linux: sudo nmcli radio wifi off

Use MAC address randomization

android

Enable MAC address randomization features if available

# Android 10+: Settings > Network & internet > Wi-Fi > Wi-Fi preferences > Advanced > Randomize MAC address

🧯 If You Can't Patch

Segment Wi-Fi networks to limit exposure to trusted devices only
Implement network monitoring for unusual RTT frame patterns or MAC address correlation attempts

🔍 How to Verify

Check if Vulnerable:

Check device chipset model and firmware version against Qualcomm's advisory. Use commands like 'adb shell getprop ro.boot.hardware' for Android devices.

Check Version:

# Android: adb shell getprop ro.build.fingerprint
# Linux: cat /proc/version

Verify Fix Applied:

Verify firmware version has been updated to post-February 2021 patches from device manufacturer.

📡 Detection & Monitoring

Log Indicators:

Unusual RTT frame patterns
Multiple MAC address correlation attempts
Wi-Fi driver errors or anomalies

Network Indicators:

Excessive RTT frame transmission
MAC address pattern analysis traffic
Unusual proximity to multiple devices

SIEM Query:

source="wifi_logs" AND ("RTT" OR "round trip time") AND ("MAC correlation" OR "sequence number comparison")

📊 Metadata

CVE ID: CVE-2020-11287

CVSS v3 Score: 7.5 (HIGH)

CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

CWE: CWE-203

Published: February 22, 2021

Last Updated: November 21, 2024

🔗 References

https://www.qualcomm.com/company/product-security/bulletins/february-2021-bulletin Vendor Advisory
https://www.qualcomm.com/company/product-security/bulletins/february-2021-bulletin Vendor Advisory

📋 TL;DR

💻 Affected Systems

📦 What is this software?

Aqt1000 by Qualcomm

Ar8031 by Qualcomm

Ar8035 by Qualcomm

Csr8811 by Qualcomm

Csra6620 by Qualcomm

Csra6640 by Qualcomm

Csrb31024 by Qualcomm

Ipq6000 by Qualcomm

Ipq6010 by Qualcomm

Ipq6018 by Qualcomm

Ipq6028 by Qualcomm

Ipq8070 by Qualcomm

Ipq8070a by Qualcomm

Ipq8071 by Qualcomm

Ipq8071a by Qualcomm

Ipq8072 by Qualcomm

Ipq8072a by Qualcomm

Ipq8074 by Qualcomm

Ipq8074a by Qualcomm

Ipq8076 by Qualcomm

Ipq8076a by Qualcomm

Ipq8078 by Qualcomm

Ipq8078a by Qualcomm

Ipq8173 by Qualcomm

Ipq8174 by Qualcomm

Pm3003a by Qualcomm

Pm4125 by Qualcomm

Pm4250 by Qualcomm

Pm456 by Qualcomm

Pm6125 by Qualcomm

Pm6150 by Qualcomm

Pm6150a by Qualcomm

Pm6150l by Qualcomm

Pm6250 by Qualcomm

Pm6350 by Qualcomm

Pm640a by Qualcomm

Pm640l by Qualcomm

Pm640p by Qualcomm

Pm660 by Qualcomm

Pm660a by Qualcomm

Pm660l by Qualcomm

Pm670 by Qualcomm

Pm670l by Qualcomm

Pm7150a by Qualcomm

Pm7150l by Qualcomm

Pm7250 by Qualcomm

Pm7250b by Qualcomm

Pm8004 by Qualcomm

Pm8005 by Qualcomm

Pm8008 by Qualcomm

Pm8009 by Qualcomm

Pm8150 by Qualcomm

Pm8150a by Qualcomm

Pm8150b by Qualcomm

Pm8150c by Qualcomm

Pm8150l by Qualcomm

Pm8250 by Qualcomm

Pm855 by Qualcomm

Pm855a by Qualcomm

Pm855b by Qualcomm

Pm855l by Qualcomm

Pm855p by Qualcomm

Pm8998 by Qualcomm

Pmc1000h by Qualcomm

Pmd9655 by Qualcomm

Pmi632 by Qualcomm

Pmi8998 by Qualcomm

Pmk8002 by Qualcomm

Pmk8003 by Qualcomm

Pmm6155au by Qualcomm

Pmm8155au by Qualcomm

Pmm8195au by Qualcomm

Pmm855au by Qualcomm

Pmp8074 by Qualcomm

Pmr525 by Qualcomm

Pmr735a by Qualcomm

Pmr735b by Qualcomm