Is CVE-2020-25855 actively exploited?

No active exploitation of CVE-2020-25855 has been confirmed so far. Continue monitoring, as exploit status can change.

Can CVE-2020-25855 be exploited remotely?

Yes. CVE-2020-25855 is exploitable remotely over the network (CVSS attack vector: Network).

What is the CVSS score of CVE-2020-25855?

CVE-2020-25855 has a CVSS score of 8.1 (HIGH).

HOME VULNERABILITIESCVE-2020-25855

HIGH

CVE-2020-25855

CWE-121Published: February 3, 2021· Updated: Jun 17, 2026

8.1

CVSS v3.1

Official Description

The function AES_UnWRAP() in the Realtek RTL8195A Wi-Fi Module prior to versions released in April 2020 (up to and excluding 2.08) does not validate the size parameter for a memcpy() operation, resulting in a stack buffer overflow which can be exploited for remote code execution or denial of service. An attacker can impersonate an Access Point and attack a vulnerable Wi-Fi client, by injecting a crafted packet into the WPA2 handshake. The attacker needs to know the network's PSK in order to exploit this.

NVD Source

Technical Analysis

CVE-2020-25855 can be exploited remotely over the network without requiring physical or adjacent access, significantly expanding the attack surface for threat actors.

The vulnerability requires no privileges and no user interaction, making it a prime target for automated exploitation campaigns and worm-like propagation.

A successful exploit results in complete confidentiality breach (data exposure), full integrity compromise (data manipulation), availability disruption (denial of service), with a CVSS base score of 8.1.