CVE-2020-17497: 
Linux Debian vulnerability analysis and mitigation

eapol.c in iNet wireless daemon (IWD) through version 1.8 contains a vulnerability that allows attackers to trigger a PTK (Pairwise Transient Key) reinstallation by retransmitting EAPOL Msg4/4. The vulnerability was disclosed on August 12, 2020, and is tracked as CVE-2020-17497 (NVD).

The vulnerability has been assigned a CVSS v3.1 base score of 8.1 (High), with an impact score of 5.2 and exploitability score of 2.8. The attack vector is adjacent network (AV:A), requiring low attack complexity (AC:L), no privileges (PR:N), and no user interaction (UI:N). The scope is unchanged (S:U), with high impact on both confidentiality (C:H) and integrity (I:H), but no impact on availability (A:N) (NVD).

The vulnerability can potentially lead to high impacts on both confidentiality and integrity of the affected systems. Since the attack vector is adjacent network and requires no privileges or user interaction, it poses a significant risk to systems running the vulnerable versions of IWD (NVD).

The vulnerability has a relatively high exploitability potential due to its low attack complexity and the fact that it requires no privileges or user interaction. The attack can be executed from an adjacent network position (NVD).

The vulnerability affects iNet wireless daemon (IWD) through version 1.8. Users should upgrade to a version newer than 1.8 to mitigate this vulnerability (Debian Security).