Ubuntu.comUB:CVE-2023-52160CVE-2023-52160
6.5 Medium
CVSS3
Attack Vector
NETWORK
Attack Complexity
LOW
Privileges Required
NONE
User Interaction
REQUIRED
Scope
UNCHANGED
Confidentiality Impact
HIGH
Integrity Impact
NONE
Availability Impact
NONE
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N
9.3 High
AI Score
Confidence
High
0.001 Low
EPSS
Percentile
35.9%
The implementation of PEAP in wpa_supplicant through 2.10 allows
authentication bypass. For a successful attack, wpa_supplicant must be
configured to not verify the network’s TLS certificate during Phase 1
authentication, and an eap_peap_decrypt vulnerability can then be abused to
skip Phase 2 authentication. The attack vector is sending an EAP-TLV
Success packet instead of starting Phase 2. This allows an adversary to
impersonate Enterprise Wi-Fi networks.
Bugs
Notes
| Author | Note |
|---|---|
| mdeslaur | Commit listed in this CVE is only a workaround for certain unrelated scenarios, as upstream claims the real issue here is misconfiguration and external components that generate bad configurations that don’t follow the documentation. See the following: http://lists.infradead.org/pipermail/hostap/2024-February/042362.html http://lists.infradead.org/pipermail/hostap/2024-February/042364.html Marking wpa in this CVE as deferred as there is no fix available. Front-end components that generate bad configuration files should be added to this CVE if any are discovered. |
Related
6.5 Medium
CVSS3
Attack Vector
NETWORK
Attack Complexity
LOW
Privileges Required
NONE
User Interaction
REQUIRED
Scope
UNCHANGED
Confidentiality Impact
HIGH
Integrity Impact
NONE
Availability Impact
NONE
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N
9.3 High
AI Score
Confidence
High
0.001 Low
EPSS
Percentile
35.9%