CVE-2023-52160

The implementation of PEAP in wpa_supplicant through 2.10 allows authentication bypass. For a successful attack, wpa_supplicant must be configured to not verify the networks TLS certificate during Phase 1 authentication, and an eap_peap_decrypt vulnerability can then be abused to skip Phase 2 authentication. The attack vector is sending an EAP-TLV Success packet instead of starting Phase 2. This allows an adversary to impersonate Enterprise Wi-Fi networks.

Weakness

When an actor claims to have a given identity, the product does not prove or insufficiently proves that the claim is correct.

Affected Software

Name	Vendor	Start Version	End Version
Debian_linux	Debian	10.0 (including)	10.0 (including)
Fedora	Fedoraproject	38 (including)	38 (including)
Fedora	Fedoraproject	39 (including)	39 (including)
Enterprise_linux	Redhat	8.0 (including)	8.0 (including)
Enterprise_linux	Redhat	9.0 (including)	9.0 (including)
Red Hat Enterprise Linux 9	RedHat	wpa_supplicant-1:2.10-5.el9	*
Wpa	Ubuntu	bionic	*
Wpa	Ubuntu	focal	*
Wpa	Ubuntu	mantic	*
Wpa	Ubuntu	oracular	*
Wpa	Ubuntu	plucky	*
Wpa	Ubuntu	trusty	*
Wpa	Ubuntu	trusty/esm	*
Wpa	Ubuntu	xenial	*

NVD	https://nvd.nist.gov/vuln/detail/CVE-2023-52160
CWE	https://cwe.mitre.org/data/definitions/287.html

Improper Authentication

Weakness

Affected Software

Potential Mitigations

References

CVE-2023-52160

Improper Authentication

Weakness

Affected Software

Potential Mitigations

Related Attack Patterns

References