CVE-2023-52160
Medium
Description
The implementation of PEAP in wpa_supplicant through 2.10 allows authentication bypass. For a successful attack, wpa_supplicant must be configured to not verify the network's TLS certificate during Phase 1 authentication, and an eap_peap_decrypt vulnerability can then be abused to skip Phase 2 authentication. The attack vector is sending an EAP-TLV Success packet instead of starting Phase 2. This allows an adversary to impersonate Enterprise Wi-Fi networks.
SeverityMedium
CVSS6.5
Exploit probability—
Product
Redhat Enterprise Linux
PublishedFeb 22, 2024
First seenFeb 22, 2024
Weakness typeCWE-287Improper authentication
How to fix
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| redhat enterprise_linux | 8.0, 9.0 | — |
| debian debian_linux | 10.0 | — |
| fedoraproject fedora | 38, 39 | — |
| w1.fi wpa_supplicant | v ≤ 2.10 | — |
Check your version
Choose the product and enter the version you run to see whether it falls in the affected range.
In the Intelligence 360 plan
Attack Surface Management
See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.