The implementation of PEAP in wpa_supplicant through 2.10 allows authentication bypass. For a successful attack, wpa_supplicant must be configured to not verify the network's TLS certificate during Phase 1 authentication, and an eap_peap_decrypt vulnerability can then be abused to skip Phase 2 authentication. The attack vector is sending an EAP-TLV Success packet instead of starting Phase 2. This allows an adversary to impersonate Enterprise Wi-Fi networks.
History

Wed, 23 Oct 2024 20:00:00 +0000

Type Values Removed Values Added
CPEs cpe:2.3:o:google:android:*:*:*:*:*:*:*:*
cpe:2.3:o:google:chrome_os:*:*:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
cpe:2.3:o:fedoraproject:fedora:38:*:*:*:*:*:*:*
cpe:2.3:o:google:android:-:*:*:*:*:*:*:*
cpe:2.3:o:google:chrome_os:-:*:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:-:*:*:*:*:*:*:*

cve-icon MITRE

Status: PUBLISHED

Assigner: mitre

Published: 2024-02-22T00:00:00

Updated: 2024-08-27T19:44:51.735Z

Reserved: 2023-12-29T00:00:00

Link: CVE-2023-52160

cve-icon Vulnrichment

Updated: 2024-08-02T22:55:40.272Z

cve-icon NVD

Status : Modified

Published: 2024-02-22T17:15:08.263

Modified: 2024-11-21T08:39:18.380

Link: CVE-2023-52160

cve-icon Redhat

Severity : Moderate

Publid Date: 2024-02-16T00:00:00Z

Links: CVE-2023-52160 - Bugzilla